Jenkins Themis Plugin
CVE-2025-64137
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Overall/Read permission
-
DeliverySupply attacker-specified HTTP server URL
-
ExploitTrigger Themis plugin outbound connection
-
ExecutionJenkins connects to attacker server
-
ImpactCapture request data or probe internal network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Jenkins user holding Overall/Read permission (the lowest authenticated tier), and the Themis Plugin at version 1.4.1 or earlier must be installed. The attacker must be able to specify an HTTP server URL that the plugin will connect to, and exploitation requires user interaction (UI:R) to trigger the outbound connection. Limiting factors: the required authenticated Overall/Read account, the need for user interaction, dependence on the Themis plugin being present, and impact limited to integrity (server-side request / connection to attacker host) with no confidentiality or availability loss. Note: the CVSS vector lists PR:N, which contradicts the described Overall/Read requirement - defenders should treat this as an authenticated-only issue. |
| Impact | This is a low-priority, low-real-risk issue despite being network-reachable. The CVSS base score is 4.3 (Medium-low), and the vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) limits impact to Integrity-Low with no confidentiality or availability loss. The EPSS score of 0.29% (20th percentile) indicates very low predicted exploitation likelihood, and there is no CISA KEV listing and no public exploit identified at time of analysis - so no signals point to active or imminent exploitation. There is a notable conflict in the data: the CVSS vector states PR:N (no privileges), but the description explicitly requires 'attackers with Overall/Read permission,' which is an authenticated (low-privilege) prerequisite - this discrepancy should be verified with the Jenkins advisory, and realistically the vector behaves as PR:L. User interaction (UI:R) is also required, further reducing automatability. Combined with the niche footprint of the Themis plugin, this is a genuinely low-urgency finding best handled through routine patching rather than emergency response. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege Jenkins account with Overall/Read permission crafts input that causes the Themis plugin to connect to an attacker-controlled HTTP server. By inducing an operator or the server to trigger this outbound connection (user interaction required), the attacker can capture request data or probe internal network resources. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows any authenticated user holding the low-privilege Overall/Read permission to make the Jenkins controller open an outbound HTTP connection to a server the attacker chooses. Exploitation requires user interaction to trigger the connection, and the assessed impact is limited to integrity only (no confidentiality or availability loss), which keeps real-world risk low despite the network-reachable attack vector. The CVSS 3.1 base score is 4.3, EPSS is 0.29% (20th percentile), no public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory confirms a fix. Note that the published vector lists PR:N while the described Overall/Read prerequisite means the issue is in practice authenticated-only.
RemediationAI
Upgrade the Jenkins Themis Plugin to the fixed version referenced in the vendor advisory (https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3517), which is the Themis release published after the affected 1.4.1 line - patch status per the vendor is 'Patch available per vendor advisory', and the exact fixed version number should be taken from that advisory rather than assumed. If the Themis Plugin is not actively used, the cleanest mitigation is to uninstall it from Manage Plugins, which removes the vulnerable endpoint entirely at the cost of losing whatever build gating functionality it provided. Where the plugin must remain, restrict which accounts hold even Overall/Read access and audit for untrusted or broad read-only users, recognizing the trade-off that Overall/Read is normally granted widely because it is required to view the Jenkins dashboard; additionally, egress filtering on the Jenkins controller - allowing outbound HTTP only to known build/dependency endpoints - blunts the attacker-chosen connection but can break legitimate plugin and job traffic and must be validated in a staging instance first. Because triggering requires user interaction, treat the vulnerable endpoint as UI-reachable traffic and monitor controller access logs for unexpected plugin URLs paired with unusual outbound connections; there is no vendor-released configuration flag that disables this specific endpoint other than removing or updating the plugin.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization): an HTTP-reachable endpoint exposed by the Jenkins Themis Plugin performs an action - initiating an outbound connection to a URL supplied by the requester - without first calling Jenkins' permission-check APIs (for example Jenkins.get().checkPermission(Jenkins.READ) or an equivalent Overall/Read check). Jenkins plugins run inside the controller JVM, so any endpoint lacking such a check is reachable by anyone who can reach the Jenkins UI/API, subject to whatever authentication the instance enforces; the advisory specifically limits the privilege needed to Overall/Read, the lowest tier of authenticated access. The CPE cpe:2.3:a:jenkins:themis:*:*:*:*:*:jenkins:*:* with version wildcarding reflects that all Themis Plugin releases up to and including 1.4.1 are in scope, distributed through the Jenkins update center. The behavior is essentially an uncontrolled server-side connection primitive (blind SSRF-style) on the controller host; the independent assessment constrains the outcome to integrity impact only, with no confidentiality or availability effect and no confirmed escalation to command execution. Because triggering the request depends on a user action, the vector carries UI:R.
Know when Themis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Description requires Overall/Read permission so PR:L (not PR:N); user interaction needed (UI:R); impact limited to integrity via forced outbound connection, so C:N/I:L/A:N.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB