CVE-2025-64133: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.
Other sources
Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to execute sandboxed Groovy code.
As of publication of this advisory, there is no fix.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64133?
CVE-2025-64133 is considered a moderate severity cross-site request forgery vulnerability allowing remote code execution.
How do I fix CVE-2025-64133?
To fix CVE-2025-64133, you should update the Jenkins Extensible Choice Parameter Plugin to version 239.v5f5c278708cf or later.
What are the potential impacts of CVE-2025-64133?
The potential impacts of CVE-2025-64133 include unauthorized execution of sandboxed Groovy code, leading to security breaches.
Who is affected by CVE-2025-64133?
CVE-2025-64133 affects users of the Jenkins Extensible Choice Parameter Plugin version 239.v5f5c278708cf and earlier.
What type of vulnerability is CVE-2025-64133?
CVE-2025-64133 is classified as a cross-site request forgery (CSRF) vulnerability.