Start Windocks Containers CVE-2025-64138
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure authenticated Jenkins user to malicious page
-
ExploitBrowser submits forged cross-site request
-
ExecutionJenkins connects to attacker-specified URL
-
ImpactServer-side request reaches attacker endpoint
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Jenkins instance to have the Start Windocks Containers Plugin version 1.4 or earlier installed, and a victim with an active authenticated Jenkins session must be socially engineered into visiting an attacker-controlled page that submits the forged request. The attack is limited by Jenkins' default CSRF protection (crumb tokens), which, when enabled, blocks this class of attack - so the realistic window is instances where CSRF protection is disabled or bypassable, plus the dependency on tricking a logged-in user. The impact is bounded to initiating an outbound connection to an attacker-chosen URL (SSRF-style), not direct code execution or data disclosure. |
| Impact | This is a genuinely moderate-to-low priority issue, and the multiple signals agree rather than conflict. The CVSS 3.1 base score is 4.3 (Medium) driven by AV:N/AC:L but limited by scope-unchanged and only a low integrity impact (C:N/I:L/A:N) - the vulnerability lets an attacker coerce the Jenkins server into connecting to an attacker-specified URL, an SSRF-style effect, not code execution or data theft. EPSS reinforces low real-world urgency at 0.21% (10th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation is neither confirmed nor demonstrated. One notable tension: the supplied CVSS vector uses PR:L/UI:N, but CWE-352 (CSRF) inherently relies on tricking an already-authenticated victim into triggering a request - classic CSRF scoring would be PR:N/UI:R (unauthenticated attacker, victim interaction required). Treat the 'authenticated attacker' reading of PR:L with caution; the practical precondition is a logged-in Jenkins user being lured to a malicious page, not attacker-held credentials. No SSVC data was provided. Overall: a real but bounded web-app flaw worth patching in routine maintenance, not an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page or link and lures an authenticated Jenkins user who has access to the affected plugin's configuration into visiting it. The forged request causes the Jenkins instance to connect to an attacker-specified URL, which can be abused to probe or reach internal/external endpoints via the server. No public exploit code is identified at time of analysis, and the network attack vector with low complexity makes the technical barrier minimal once a victim is tricked. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Cross-site request forgery in the Jenkins Start Windocks Containers Plugin 1.4 and earlier lets an attacker cause the Jenkins controller to open an outbound connection to a URL of the attacker's choosing by luring a victim into submitting a forged request. The assessed impact is limited to the integrity of that connection endpoint (CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) - an SSRF-style issue rather than code execution or data disclosure - and it only succeeds when Jenkins' default CSRF crumb protection is disabled or bypassable and a victim with an active authenticated session is socially engineered. EPSS is very low (0.21%, 10th percentile), there is confirmed actively exploited status absent from CISA KEV, and no public exploit identified at time of analysis; this makes it a moderate-to-low priority, and the multiple signals agree rather than conflict.
RemediationAI
The primary fix is to upgrade the Start Windocks Containers Plugin to the patched version named in Jenkins Security Advisory SECURITY-3531 (https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3531); patch status is not explicitly confirmed in the supplied data other than through that advisory, so verify the fixed version there before upgrading. If the plugin is not actually needed, uninstalling it removes the attack surface entirely and is the cleanest side-effect-free option. As a compensating control, ensure Jenkins' built-in CSRF protection (crumb tokens) remains enabled and has not been disabled or bypassed, since that control is what blocks this class of forged request - reinstating it has no functional downside beyond requiring clients to fetch a crumb. Additionally, restrict outbound network egress from the Jenkins controller to only the destinations it legitimately needs, which limits the utility of the attacker-chosen URL and the SSRF-style reachability even if a forged request succeeds; the trade-off is that legitimate plugin connections to Windocks or other approved hosts must be explicitly whitelisted. Finally, because exploitation requires a victim's authenticated browser session, limiting who can hold Jenkins sessions and avoiding browsing untrusted sites while logged in reduces exposure.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-352 (Cross-Site Request Forgery) is the root-cause class here. The Start Windocks Containers Plugin exposes a Jenkins HTTP endpoint that accepts a target URL and initiates an outbound connection to it, but it does not require an unforgeable token to accompany that state-changing request. Because Jenkins authenticates users with session cookies, a browser that already holds a valid Jenkins session will automatically attach credentials to any request the plugin endpoint receives - including one submitted silently by a page on an unrelated origin. The CPE cpe:2.3:a:jenkins:start_windocks_container:*:*:*:*:*:jenkins:*:* confirms the affected artifact is the Jenkins plugin distribution for versions up to and including 1.4, deployed inside a Jenkins controller. The practical consequence of the missing anti-CSRF protection is that the controller, not the attacker, performs the outbound request, giving the flaw an SSRF-like character: the plugin's ability to reach an attacker-specified URL from the Jenkins host is abused, which is why the integrity impact is bounded and confidentiality/availability impact is assessed as none.
Know when Start Windocks Container gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CSRF needs no attacker privileges but requires luring an authenticated victim, so PR:N/UI:R; impact is limited to forcing an outbound connection, giving I:L with C:N/A:N.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
GitHub PoC
Exploit-DB