Extensible Choice Parameter CVE-2025-64133

Exploitation requires a victim who is an authenticated Jenkins user with an active session to be lured into interacting with an attacker-controlled page (UI:R), the classic CSRF prerequisite - the attacker cannot act directly. The target must run Jenkins Extensible Choice Parameter Plugin version 239.v5f5c278708cf or earlier. Impact is inherently limited because the injected Groovy runs inside the Jenkins script sandbox rather than as unrestricted code, bounding confidentiality (C:N) and yielding only Low integrity and availability impact. Standard Jenkins CSRF protection (crumbs), where effective, and absence of the vulnerable plugin both negate the attack.

This is a moderate-severity CSRF issue (CVSS 5.4) rather than a top-tier priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L shows network reach and low complexity but no confidentiality impact and only Low integrity/availability impact, consistent with CWE-352 where the attacker rides an authenticated Jenkins user's session rather than acting directly. The critical limiting factor is UI:R: successful exploitation requires tricking a logged-in Jenkins user into interacting with a crafted page, which is why the score stays mid-range despite PR:N. EPSS is low at 0.26% (16th percentile), the CVE is NOT in CISA KEV, and no public exploit is identified, so all three real-world-exploitation signals align toward low urgency. The payload is further constrained because the Groovy code executes inside the Jenkins script sandbox, bounding the blast radius. No signals conflict here; the main uncertainty is that only a vendor advisory and oss-security post are referenced, with no independent confirmation of affected-version boundaries beyond NVD/Jenkins data.

An attacker crafts a malicious web page that issues a forged request to a Jenkins instance; when an authenticated Jenkins user with an active session visits the page, the request triggers execution of attacker-supplied sandboxed Groovy code in the Extensible Choice Parameter Plugin. No public proof-of-concept is identified, and the attack depends on the victim's interaction (UI:R) and an active authenticated session.