A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2956aba3-1fcb-4c39-9cea-d88a46a3bf93 advisory.

    Jenkins Security Advisory:
    Denial of service vulnerability in HTTP-based CLI     Missing permission check on password fields     Build authorization token stored and displayed in plain text     CSRF vulnerability on the login form

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with
    View/Read permission to view encrypted password values in views. (CVE-2025-67636)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage     results ID when creating coverage results, only when submitting the job configuration through the UI,     allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by     configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.
    (CVE-2025-67641)

  - Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace     directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers     able to control the workspace directory name to inject arbitrary OS commands. (CVE-2025-67640)

  - A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with     View/Read permission to view encrypted password values in views. (CVE-2025-67636)

  - Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for     Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially     capture Vault credentials they are not entitled to. (CVE-2025-67642)

  - A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to     see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this     fix, anyone could see this list as a dropdown on the Jenkins UI. (CVE-2025-13472)

  - Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly     perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers     with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.
    (CVE-2025-67643)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
278586	FreeBSD : jenkins -- multiple vulnerabilities (2956aba3-1fcb-4c39-9cea-d88a46a3bf93)	Nessus	FreeBSD Local Security Checks	medium
436354	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-p3f5-98cv-562j)	Tenable Cloud Security	SCA Checks	medium
436354	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-p3f5-98cv-562j)	Tenable Self-Hosted Container Security	SCA Checks	medium
278130	Jenkins plugins Multiple Vulnerabilities (2025-12-10)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2025-67636

medium

Tenable Plugins

medium

medium

medium

medium