CVE-2025-64137: CSRF
A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
Other sources
Jenkins Themis Plugin 1.4.1 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64137?
CVE-2025-64137 has been classified as a high severity vulnerability.
How do I fix CVE-2025-64137?
To fix CVE-2025-64137, update the Jenkins Themis Plugin to version 1.4.2 or later.
Who is affected by CVE-2025-64137?
Any instance of Jenkins Themis Plugin version 1.4.1 or earlier is affected by CVE-2025-64137.
What kind of attack can exploit CVE-2025-64137?
CVE-2025-64137 can be exploited by attackers to connect to an attacker-specified HTTP server.
What permissions are required to exploit CVE-2025-64137?
To exploit CVE-2025-64137, an attacker needs Overall/Read permission on the Jenkins server.