CVE-2025-64138

MediumCVSS 4.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.

Risk Assessment

An attacker could trick an authenticated Jenkins user into making unintended requests, potentially leading to unauthorized connections to attacker-controlled external resources.

Recommendation

Update the Jenkins Start Windocks Containers Plugin to a version newer than 1.4 or remove it if it is not in use.

Other vulnerabilities in Jenkins Start Windocks Containers Plugin

CVE-2025-64139Medium
Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.

Original NVD description (English source)

A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS