Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when
    accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view
    encrypted values of secrets. (CVE-2025-27623)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the cb98d018-f9f5-11ef-a398-00e081b7aa2d advisory.

    Jenkins Security Advisory:
    Encrypted values of secrets stored in agent configuration revealed to users with Agent/Extended Read     permission     Encrypted values of secrets stored in view configuration revealed to users with View/Read permission     CSRF vulnerability     Open redirect vulnerability

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.492.2 or Jenkins weekly prior to 2.500. It is, therefore, affected by multiple vulnerabilities:

  - Medium Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not require POST requests for the HTTP     endpoint toggling collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor     Status widgets), resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows     attackers to have users toggle their collapsed/expanded status of sidepanel widgets. Additionally, as the     API accepts any string as the identifier of the panel ID to be toggled, attacker-controlled content can be     stored in the victim's user profile in Jenkins. Jenkins 2.500, LTS 2.492.2 requires POST requests for the     affected HTTP endpoint. (CVE-2025-27624)

  - Medium Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when     accessing config.xml of agents via REST API or CLI. This allows attackers with Agent/Extended Read     permission to view encrypted values of secrets. This issue is related to SECURITY-266 in the 2016-05-11     security advisory. Jenkins 2.500, LTS 2.492.2 redacts the encrypted values of secrets stored in agent     config.xml accessed via REST API or CLI for users lacking Agent/Configure permission. (CVE-2025-27622)

  - Medium Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when     accessing config.xml of views via REST API or CLI. This allows attackers with View/Read permission to view     encrypted values of secrets. This issue is related to SECURITY-266 in the 2016-05-11 security advisory.
    Jenkins 2.500, LTS 2.492.2 redacts the encrypted values of secrets stored in view config.xml accessed via     REST API or CLI for users lacking View/Configure permission. (CVE-2025-27623)

  - Medium Various features in Jenkins redirect users to partially user-controlled URLs inside Jenkins. To     prevent open redirect vulnerabilities, Jenkins limits redirections to safe URLs (neither absolute nor     scheme-relative/network-path reference). In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects     starting with backslash (\) characters are considered safe. This allows attackers to perform phishing     attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers     interpret these characters as part of scheme-relative redirects. Jenkins 2.500, LTS 2.492.2 considers     redirects to URLs starting with backslash (\) characters to be unsafe, rejecting such redirects.
    (CVE-2025-27625)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
421051	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-rfh6-9r2q-98vf)	Tenable Cloud Security	SCA Checks	Local	medium
421051	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-rfh6-9r2q-98vf)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
232202	FreeBSD : jenkins -- multiple vulnerabilities (cb98d018-f9f5-11ef-a398-00e081b7aa2d)	Nessus	FreeBSD Local Security Checks	Local	medium
227562	Jenkins LTS < 2.492.2 / Jenkins weekly < 2.500 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	medium

Detections

Analytics

CVE-2025-27623

medium

Tenable Plugins

medium

medium

medium

medium