Jenkins CVE-2025-67638

Exploitation requires an authenticated Jenkins account with access to the affected job's configuration form, where the build authorization token is rendered in cleartext instead of being masked (CWE-312). The relevant feature is the per-job build-trigger authorization token field on the job configuration page. Limiting factors: the attacker must hold valid credentials and the permission needed to view the job configuration form (PR:L, consistent with CVSS); there is no remote unauthenticated path and no code execution - only confidentiality of the token is at stake (C:L, I:N, A:N). Real-world risk is further bounded to contexts where unauthorized or over-privileged users, screen sharing, or screenshots can expose the displayed value.

This is a low-to-moderate priority information-disclosure issue, not an urgent threat. The CVSS 3.1 base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects the limited impact: network vector and low complexity, but it requires existing privileges (PR:L, i.e. an authenticated user) and yields only a low confidentiality impact with no integrity or availability effect. All exploitation signals point the same way and are consistent with each other: EPSS is 0.16% (5th percentile), indicating very low predicted exploitation likelihood; the issue is NOT in CISA KEV; and no public exploit code was identified in the provided data. CWE-312 (cleartext/unmasked storage of sensitive information) matches the description of an unmasked token in a form field. There is no conflict between the signals - all of CVSS, EPSS, and absence of KEV/POC agree this is a real but low-severity hardening/defense-in-depth gap. The practical risk is bounded by the fact that an attacker must already have authenticated access to the job configuration form; the primary danger is secondary exposure (shoulder-surfing, screen sharing, screenshots, or over-privileged users viewing tokens they should not reuse). Severity could rise modestly in environments where many low-privilege users can view job configuration pages.

An authenticated Jenkins user who can open a job's configuration form views the build authorization token rendered in cleartext rather than masked, then captures it (by reading, screenshotting, or observing a shared screen). The attacker reuses the captured token to trigger builds for that job. No public exploit code is required given the token is simply displayed on the page; exploitation complexity is low (AC:L) but requires prior low-level privileges (PR:L).