A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 45276ea6-1653-4240-9986-ccfc6fec7ece advisory.

    Jenkins Security Advisory:
    Missing permission check allows retrieving agent configurations     Missing permission check allows retrieving secrets from agent configurations

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with
    Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to
    encrypted secrets in its configuration. (CVE-2025-31721)

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.492.3 or Jenkins weekly prior to 2.504. It is, therefore, affected by multiple vulnerabilities:

  - A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with     Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to     encrypted secrets in its configuration. (CVE-2025-31721)

  - A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with     Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access     to its configuration. (CVE-2025-31720)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234188	FreeBSD : jenkins -- multiple vulnerabilities (45276ea6-1653-4240-9986-ccfc6fec7ece)	Nessus	FreeBSD Local Security Checks	medium
423637	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-wr6w-jxg7-qpfh)	Tenable Cloud Security	SCA Checks	medium
423637	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-wr6w-jxg7-qpfh)	Tenable Self-Hosted Container Security	SCA Checks	medium
233779	Jenkins LTS < 2.492.3 / Jenkins weekly < 2.504 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2025-31721

medium

Tenable Plugins

medium

medium

medium

medium