Description

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Remediation

References

CVE-2025-67638

Related Vulnerabilities

WordPress Plugin PictPress 'resize.php' Multiple Local File Include Vulnerabilities (1.0)

WordPress Plugin Responsive Slider-Image Slider-Slideshow for WordPress Multiple Vulnerabilities (2.7.5)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-17302)

WordPress 5.4.x Multiple Vulnerabilities (5.4 - 5.4.14)

WordPress Plugin Login/Signup Popup (Inline Form + Woocommerce) Cross-Site Request Forgery (2.2)

Severity

Medium

Classification

CVE-2025-67638 CWE-312 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities