Missing Permission Check in Jenkins Themis Plugin Affects Multiple Versions

CVE-2025-64137

What is CVE-2025-64137?

A vulnerability exists in Jenkins Themis Plugin due to a missing permission check, allowing users with Overall/Read access to connect to arbitrary HTTP servers. This can lead to potential data exposure and exploitation by malicious actors who may manipulate the connection for unauthorized access to sensitive information. It is essential for users to review their plugin configurations and apply necessary updates to mitigate risks associated with this flaw.

References