Jenkins CVE-2025-67639

Exploitation requires the victim to be tricked into visiting an attacker-controlled web page while their browser can reach the target Jenkins instance (UI:R), and the attack delivers login CSRF - forcing the victim to authenticate into the attacker's account rather than compromising the victim's own session. Limiting factors: the attack depends on social engineering to get the victim to the malicious page, affects only Jenkins 2.540/LTS 2.528.2 and earlier, and yields only limited confidentiality impact (the attacker observes what the victim does inside the attacker-owned account) with no direct integrity or availability loss. The published vector lists PR:L, implying some authentication context, though this vulnerability class is commonly reachable by an unauthenticated external attacker.

This is a low-severity, low-priority issue that does not warrant emergency patching. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) yields a base score of 3.5 (Low), reflecting that exploitation requires user interaction (UI:R) and yields only limited confidentiality impact with no integrity or availability impact. The EPSS score of 0.19% (8th percentile) is low, indicating a very low probability of exploitation in the next 30 days. There is no CISA KEV listing (not actively exploited) and no public exploit code identified, so all exploitation signals align toward low real-world risk. One data tension worth noting: the published vector specifies PR:L (attacker needs some authentication), yet a login-CSRF attack of this class is typically mounted by an unauthenticated external attacker using their OWN credentials to trick the victim - verify the privilege requirement with the Jenkins advisory. Overall this is a genuinely low-priority finding whose signals (low CVSS, low EPSS, no KEV, no POC) are consistent rather than conflicting.

An attacker crafts a malicious web page that silently submits a login request to a victim's Jenkins instance using the attacker's own credentials; when a logged-out victim visits the page, their browser is forced to authenticate as the attacker. The victim then unknowingly operates inside the attacker-controlled account, where subsequent actions, saved tokens, or configuration may be captured by the attacker. No public exploit code is identified at time of analysis, and the attack requires the victim to interact with the malicious page (UI:R).