Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2956aba3-1fcb-4c39-9cea-d88a46a3bf93 advisory.

    Jenkins Security Advisory:
    Denial of service vulnerability in HTTP-based CLI     Missing permission check on password fields     Build authorization token stored and displayed in plain text     CSRF vulnerability on the login form

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job
    config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read
    permission or access to the Jenkins controller file system. (CVE-2025-67637)

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.528.3 or Jenkins weekly prior to 2.541. It is, therefore, affected by multiple vulnerabilities:

  - A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier     allows attackers to trick users into logging in to the attacker's account. (CVE-2025-67639)

  - Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on     the job configuration form, increasing the potential for attackers to observe and capture them.
    (CVE-2025-67638)

  - Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when     the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
    (CVE-2025-67635)

  - Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job     config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read     permission or access to the Jenkins controller file system. (CVE-2025-67637)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
278586	FreeBSD : jenkins -- multiple vulnerabilities (2956aba3-1fcb-4c39-9cea-d88a46a3bf93)	Nessus	FreeBSD Local Security Checks	medium
436346	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-fxj7-6v9w-xc76)	Tenable Cloud Security	SCA Checks	medium
436346	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-fxj7-6v9w-xc76)	Tenable Self-Hosted Container Security	SCA Checks	medium
278129	Jenkins LTS < 2.528.3 / Jenkins weekly < 2.541 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2025-67637

medium

Tenable Plugins

medium

medium

medium

medium