Description

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets).

Remediation

References

CVE-2025-27624

Related Vulnerabilities

WordPress Plugin Advanced Custom Fields:reCAPTCHA Field Security Bypass (1.1.1)

WordPress Plugin PixCodes Cross-Site Scripting (2.3.6)

WordPress Plugin Uploader Cross-Site Scripting and Arbitrary File Upload Vulnerabilities (1.0.4)

Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-0155)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce SQL Injection (4.1.7)

Severity

Medium

Classification

CVE-2025-27624 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Tags

Missing Update Known Vulnerabilities