CVE-2025-64142: CSRF
A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Other sources
Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64142?
CVE-2025-64142 is considered a critical vulnerability due to the potential for unauthorized access to attacker-specified URLs.
How do I fix CVE-2025-64142?
To fix CVE-2025-64142, upgrade the Jenkins Nexus Task Runner Plugin to version 0.9.3 or later.
Who is affected by CVE-2025-64142?
CVE-2025-64142 affects users of Jenkins Nexus Task Runner Plugin version 0.9.2 and earlier.
What type of vulnerability is CVE-2025-64142?
CVE-2025-64142 is a missing permission check vulnerability.
What permissions are required to exploit CVE-2025-64142?
To exploit CVE-2025-64142, an attacker needs Overall/Read permission.