CVE-2025-67637: Medium severity Jenkins Jenkins vulnerability
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.528.3 - Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.541
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67637?
CVE-2025-67637 is rated as a medium severity vulnerability.
How do I fix CVE-2025-67637?
To resolve CVE-2025-67637, you should upgrade to Jenkins version 2.541 or later, or LTS version 2.528.3 or later.
What types of data are exposed in CVE-2025-67637?
CVE-2025-67637 exposes build authorization tokens stored unencrypted in job config.xml files.
Who is affected by CVE-2025-67637?
Users with Item/Extended Read permission or access to the Jenkins controller file system are affected by CVE-2025-67637.
What are the implications of CVE-2025-67637?
If exploited, CVE-2025-67637 may allow unauthorized access to sensitive build authorization tokens.