CVE-2025-59474 Affecting jenkins package, versions <2.528-r0


Severity

Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
0.3% (53rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-JENKINS-13326556
  • published6 Oct 2025
  • disclosed17 Sept 2025

Introduced: 17 Sep 2025

NewCVE-2025-59474  (opens in a new tab)

How to fix?

Upgrade Minimos:latest jenkins to version 2.528-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jenkins package and not the jenkins package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.

CVSS Base Scores

version 3.1