CVE-2025-31720: Medium severity jenkins lts vulnerability
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.
Other sources
Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.
Jenkins 2.504, LTS 2.492.3 requires Computer/Extended Read permission to copy an agent.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31720?
CVE-2025-31720 is classified as a critical vulnerability due to its ability to allow unauthorized access to agent configurations.
How do I fix CVE-2025-31720?
To fix CVE-2025-31720, upgrade Jenkins to version 2.504 or later, or LTS to 2.492.3 or later.
What versions of Jenkins are affected by CVE-2025-31720?
Jenkins versions up to 2.503 and Jenkins LTS versions up to 2.492.2 are affected by CVE-2025-31720.
What impact does CVE-2025-31720 have on Jenkins installations?
CVE-2025-31720 allows attackers to gain unauthorized access to an agent's configuration, potentially compromising the Jenkins environment.
Who can exploit CVE-2025-31720?
An attacker with Computer/Create permission but lacking Computer/Extended Read permission can exploit CVE-2025-31720.