Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
References
| Link | Resource |
|---|---|
| https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
17 Dec 2025, 17:37
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* |
|
| First Time |
Jenkins jenkins
Jenkins |
|
| References | () https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783 - Vendor Advisory |
10 Dec 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-312 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
10 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-10 17:15
Updated : 2025-12-17 17:37
NVD link : CVE-2025-67638
Mitre link : CVE-2025-67638
CVE.ORG link : CVE-2025-67638
JSON object : View
Products Affected
jenkins
- jenkins
CWE
CWE-312
Cleartext Storage of Sensitive Information