CVE-2025-64136: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.
Other sources
Jenkins Themis Plugin 1.4.1 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64136?
CVE-2025-64136 is rated as a Medium severity vulnerability due to its potential for cross-site request forgery.
How do I fix CVE-2025-64136?
To fix CVE-2025-64136, update Jenkins Themis Plugin to version 1.4.2 or later.
What systems are affected by CVE-2025-64136?
CVE-2025-64136 affects Jenkins Themis Plugin version 1.4.1 and earlier.
What type of attack does CVE-2025-64136 facilitate?
CVE-2025-64136 facilitates cross-site request forgery (CSRF) attacks.
Can CVE-2025-64136 allow data theft?
Yes, CVE-2025-64136 can potentially allow attackers to send unauthorized requests to a user’s session, leading to data exposure.