CVE-2025-64141

MediumCVSS 4.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The Jenkins Nexus Task Runner Plugin version 0.9.2 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

Risk Assessment

An attacker can exploit CSRF to perform unauthorized actions in the context of a logged-in user, potentially leading to system security compromise.

Recommendation

Update the Jenkins Nexus Task Runner Plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Jenkins Nexus Task Runner Plugin

CVE-2025-64142Medium
Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

Original NVD description (English source)

A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS