CVE-2025-64139: CSRF
A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Other sources
Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64139?
The severity of CVE-2025-64139 is considered to be high due to the potential for unauthorized access to sensitive functionalities.
How do I fix CVE-2025-64139?
To fix CVE-2025-64139, upgrade to Jenkins Start Windocks Containers Plugin version 1.5 or later, where the permission checks have been implemented.
What are the impacts of CVE-2025-64139?
CVE-2025-64139 allows attackers with Overall/Read permission to connect to arbitrary URLs, potentially leading to unauthorized access or control.
Who is affected by CVE-2025-64139?
Users of Jenkins Start Windocks Containers Plugin version 1.4 and earlier are affected by CVE-2025-64139.
Is there a workaround for CVE-2025-64139?
Currently, there are no documented workarounds for CVE-2025-64139; updating to a secure version is the recommended approach.