Jenkins Themis Plugin
CVE-2025-64136
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious web page
-
ExploitLure authenticated Jenkins user
-
ExecutionSubmit forged cross-site request
-
ImpactPlugin connects to attacker HTTP server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Jenkins user with the Themis Plugin (version 1.4.1 or earlier) installed to visit attacker-controlled web content while logged in, which triggers the forged request (no CSRF protection on the affected endpoint). Limiting factors: the victim must actively interact with the malicious page (UI:R), a valid Jenkins session must be active, and only instances running the vulnerable Themis Plugin versions are affected; impact is confined to forcing an outbound HTTP connection to an attacker-specified server (integrity-only, I:L). |
| Impact | This is a genuinely low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) yields a 4.3 MEDIUM score, driven almost entirely by network reach; the real-world risk is constrained by two factors the base score reflects: it requires user interaction (UI:R) - a logged-in Jenkins user must be lured into triggering the forged request - and the impact is limited to low integrity (I:L) with no confidentiality or availability loss. The signals are consistent rather than conflicting: EPSS is low at 0.23% (12th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided references. The lack of PR requirement (PR:N) classifies this as unauthenticated per the vector, but the practical gate is that an attacker cannot act alone - exploitation hinges on tricking a victim. This is a classic high-reach/low-consequence CSRF typical of Jenkins plugin advisories, not an urgent patch-now priority; remediate on a normal maintenance cadence. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page and lures an authenticated Jenkins user into visiting it; the page silently submits a forged request to the Jenkins instance, causing the Themis Plugin to initiate a connection to an attacker-controlled HTTP server. No public exploit code was identified at time of analysis, and success depends on the victim being logged in and interacting with the attacker's content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Cross-site request forgery in Jenkins Themis Plugin 1.4.1 and earlier lets an attacker cause an affected Jenkins controller to open an outbound connection to an attacker-specified HTTP server by luring a victim into visiting malicious web content. The affected endpoint performs no CSRF validation, so the forged request is executed in the security context of the victim's active Jenkins session; the CVSS vector (AV:N/AC:L/PR:N/UI:R) means the attacker needs no credentials but must persuade a logged-in user to interact with attacker-controlled content. Impact is confined to integrity (C:N/I:L/A:N), EPSS is only 0.23% (percentile 12), and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV: not listed).
RemediationAI
Apply the fix identified in the Jenkins security advisory SECURITY-3517 (https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3517): upgrade the Themis Plugin past the 1.4.1 boundary to the fixed release named in that advisory - the available input data does not confirm an exact fixed version number, so verify the version against the advisory rather than assuming one. Because the flaw is a missing CSRF check inside a plugin, no Jenkins core setting will patch it directly; core-level CSRF protections do not automatically extend to a plugin endpoint that fails to request a crumb. If upgrading immediately is not possible, the highest-value compensating control is to uninstall or disable the Themis Plugin on controllers that do not need it, which removes the vulnerable endpoint entirely at the cost of losing the plugin's functionality; if the plugin is required, restrict Jenkins UI access to trusted networks or VPN, reduce the number of privileged sessions that remain logged in while users browse external sites, and consider using a browser profile that is not authenticated to Jenkins for general web browsing to shrink the CSRF window. Log out of Jenkins when not actively using it, and monitor controller egress for unexpected connections to unfamiliar HTTP servers initiated by the plugin - these measures reduce likelihood but do not eliminate the missing-token root cause, so the plugin upgrade remains the only complete fix.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-352 (Cross-Site Request Forgery): a Jenkins plugin endpoint that mutates configuration or triggers an outbound action does not enforce an anti-CSRF token (in Jenkins, typically a 'crumb'). Because browsers automatically attach the victim's Jenkins session cookie to cross-origin requests, a page controlled by the attacker can submit a forged request to the Jenkins controller and have it processed as a legitimate, authenticated action. Here the forged action makes the Themis Plugin connect to an HTTP server chosen by the attacker, giving the attacker a degree of control over the controller's outbound traffic and any data exchanged with that endpoint. The CPE string cpe:2.3:a:jenkins:themis:*:*:*:*:*:jenkins:*:* with a wildcard version field indicates the entire published version history of the plugin up to and including 1.4.1 is considered affected within the Jenkins product target, so the exposure is tied to whether the plugin is installed on the controller rather than to a specific Jenkins core release. The Themis Plugin is a Jenkins plugin (not Jenkins core), so the vulnerable code is only reachable on controllers where that plugin has been installed; the three primary fault lines are (1) missing CSRF token verification on the affected request handler, (2) no server-side validation or allow-listing of the target HTTP server the plugin is asked to connect to, and (3) reliance on the browser session alone as the authorization signal.
Know when Themis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CSRF needs no attacker auth (PR:N) but relies on a logged-in victim clicking (UI:R); impact is forcing an outbound connection, so I:L with no confidentiality or availability loss.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
GitHub PoC
Exploit-DB