In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3505 | Vendor Advisory |
Configurations
History
29 Apr 2025, 13:52
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Jenkins
Jenkins templating Engine |
|
| CPE | cpe:2.3:a:jenkins:templating_engine:*:*:*:*:*:jenkins:*:* | |
| References | () https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3505 - Vendor Advisory |
02 Apr 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-02 15:15
Updated : 2025-04-29 13:52
NVD link : CVE-2025-31722
Mitre link : CVE-2025-31722
JSON object : View
Products Affected
jenkins
- templating_engine
CWE
No CWE.