CVE-2025-64142

MediumCVSS 4.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

Risk Assessment

A low-privileged attacker can abuse the Jenkins server to connect to arbitrary network resources, potentially leading to data leakage or lateral movement within the internal network.

Recommendation

Upgrade Jenkins Nexus Task Runner Plugin to a version newer than 0.9.2. Restrict Overall/Read permission to trusted users only.

Other vulnerabilities in Jenkins Nexus Task Runner Plugin

CVE-2025-64141Medium
The Jenkins Nexus Task Runner Plugin version 0.9.2 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

Original NVD description (English source)

A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS