Description

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Remediation

References

CVE-2025-67638

Related Vulnerabilities

OpenSSL NULL Pointer Dereference Vulnerability (CVE-2026-42765)

MediaWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-58025)

Oracle Database Server CVE-2012-0526 Vulnerability (CVE-2012-0526)

osTicket Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-7193)

Magento Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2019-7950)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-312 CVE-2025-67638