What is the CVSS score of CVE-2026-57292?

CVE-2026-57292 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Jenkins Gitee Plugin CVE-2026-57292

EUVD-2026-38773 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-24 jenkins

GHSA-w794-rwp2-jc9m

CSRF Jenkins Jenkins Gitee Plugin

5.4

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.6 MEDIUM

CSRF inherently requires victim browser interaction (UI:R, not UI:N); PR:L reflects the required authenticated Jenkins session on the victim side.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 16:23 vuln.today

CVSS changed

Jun 24, 2026 - 16:22 NVD

5.4 (None) 5.4 (MEDIUM)

CVE Published

Jun 24, 2026 - 13:20 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.

AnalysisAI

Cross-site request forgery in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows network-accessible attackers to force a Jenkins instance to initiate connections to attacker-controlled URLs, using credential IDs previously obtained through a separate method. The CVSS vector confirms a low-privileged authenticated attacker posture (PR:L), meaning the victim must hold an active Jenkins session. No active exploitation is confirmed per CISA KEV, and the SSVC framework rates exploitation as currently none with partial technical impact.

Technical ContextAI

Jenkins is a widely deployed open-source CI/CD automation server. The Gitee Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_gitee_plugin:*:*:*:*:*:*:*:*) integrates Jenkins with Gitee, a Git hosting platform popular in the Chinese developer ecosystem. CSRF (CWE-352) vulnerabilities in Jenkins plugins typically arise when form action endpoints or configuration-testing APIs do not validate Jenkins' built-in CSRF protection token (crumb). An attacker who already possesses valid Jenkins credential IDs - obtained through a separate information-disclosure or enumeration vulnerability - can craft a forged request that, when executed by an authenticated user's browser, directs Jenkins to connect outbound to an arbitrary URL using those credential IDs. This is a server-side request forgery primitive chained with CSRF, not a simple reflected attack.

RemediationAI

Patch available per vendor advisory: update the Jenkins Gitee Plugin to the version released in the Jenkins security advisory published 2026-06-24, available at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3762%20(1). The exact fixed version number is not independently confirmed from the available input data - administrators should verify the target version directly from the advisory before upgrading. As a compensating control pending upgrade, restrict access to the Jenkins UI to trusted network segments to reduce the attacker's ability to deliver a forged request to an authenticated user. Additionally, enforce strict HTTP Referer/Origin validation at the reverse proxy or WAF layer in front of Jenkins. Note that neither compensating control eliminates the root CSRF defect and should not be considered a permanent substitute for patching.