CVE-2025-64141: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
Other sources
Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64141?
CVE-2025-64141 is classified as a medium severity vulnerability.
How does CVE-2025-64141 affect Jenkins Nexus Task Runner Plugin users?
CVE-2025-64141 allows attackers to exploit CSRF to connect to an attacker-specified URL with arbitrary credentials.
How do I fix CVE-2025-64141?
To fix CVE-2025-64141, update the Jenkins Nexus Task Runner Plugin to version 0.9.3 or later.
Is CVE-2025-64141 present in all versions of the Jenkins Nexus Task Runner Plugin?
CVE-2025-64141 affects Jenkins Nexus Task Runner Plugin versions 0.9.2 and earlier.
What are the risks of not addressing CVE-2025-64141?
Failing to address CVE-2025-64141 may lead to unauthorized access and exploitation of sensitive systems.