Nexus Task Runner CVE-2025-64142

Requires an authenticated Jenkins user holding Overall/Read permission on an instance running Nexus Task Runner Plugin version 0.9.2 or earlier; the vulnerable endpoint performs no additional permission check (CWE-862). Exploitation is limited by that authentication requirement and by the bounded impact - the attacker can cause Jenkins to connect to an arbitrary URL using credentials already stored in Jenkins, but cannot directly read secrets (they supply the credential IDs) or affect availability. Real-world exposure rises sharply where Overall/Read is granted to anonymous/low-trust users, a common Jenkins misconfiguration; it is minimal where read access is tightly restricted.

This is a genuinely low-priority issue despite being a real vulnerability. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects limited impact: network vector and low attack complexity, but it requires an authenticated attacker holding Overall/Read permission (PR:L), and the only impact is low integrity (I:L) with no confidentiality or availability loss. EPSS is correspondingly low at 0.25% (15th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis - all three exploitation signals agree that this is not under active or imminent broad exploitation. The signals are internally consistent rather than conflicting: a low-privilege authenticated flaw in a niche plugin with a minor impact ceiling. The practical concern is that Overall/Read is a very common, low-trust permission in many Jenkins instances (often granted broadly or even anonymously), which lowers the real-world barrier somewhat and makes this a server-side request forgery / credential-misuse primitive. Even so, the bounded integrity-only impact keeps this firmly below patch-now urgency; treat it as a routine plugin-update item.

An attacker who has been granted (or can obtain) Overall/Read access to a Jenkins instance running Nexus Task Runner Plugin 0.9.2 or earlier invokes the unprotected plugin endpoint, supplying a URL they control and credential IDs stored in Jenkins. Jenkins then connects outbound to the attacker-chosen URL, enabling server-side request forgery against internal systems and potential probing/misuse of stored credentials. No public exploit code has been identified at time of analysis, and exploitation requires only low-privileged authentication, not administrator rights.