CVE-2025-64138: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.
Other sources
Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64138?
CVE-2025-64138 is classified as a medium severity cross-site request forgery (CSRF) vulnerability.
How do I fix CVE-2025-64138?
To fix CVE-2025-64138, upgrade the Jenkins Start Windocks Containers Plugin to version 1.5 or later.
What impact does CVE-2025-64138 have on my Jenkins instance?
CVE-2025-64138 allows an attacker to connect to unauthorized URLs, potentially leading to data breaches or system compromise.
Is CVE-2025-64138 exploited in the wild?
As of now, there are no reports of active exploitation in the wild for CVE-2025-64138.
Which versions of the Jenkins Start Windocks Containers Plugin are affected by CVE-2025-64138?
CVE-2025-64138 affects versions of the Jenkins Start Windocks Containers Plugin up to and including version 1.4.