CVE-2025-64136

MediumCVSS 4.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.

Risk Assessment

An attacker can exploit CSRF to force a victim to perform unwanted actions, such as connecting to an external server, potentially leading to data leakage or further attacks.

Recommendation

Update the Themis plugin to the latest patched version. Additionally, implement CSRF protection mechanisms such as CSRF tokens.

Other vulnerabilities in Jenkins Themis Plugin

CVE-2025-64137Medium
A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

Original NVD description (English source)

A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS