According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage     results ID when creating coverage results, only when submitting the job configuration through the UI,     allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by     configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.
    (CVE-2025-67641)

  - Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace     directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers     able to control the workspace directory name to inject arbitrary OS commands. (CVE-2025-67640)

  - A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with     View/Read permission to view encrypted password values in views. (CVE-2025-67636)

  - Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for     Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially     capture Vault credentials they are not entitled to. (CVE-2025-67642)

  - A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to     see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this     fix, anyone could see this list as a dropdown on the Jenkins UI. (CVE-2025-13472)

  - Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly     perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers     with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.
    (CVE-2025-67643)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Jenkins plugins Multiple Vulnerabilities (2025-12-10)

medium Nessus Plugin ID 278130

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Mar 2, 2026, 12:44 PM CVSS metrics ("CVSSv2 score" set to 5.5) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N") CVSS metrics ("CVSSv3 score" set to 5.4) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N") CVSSv2 severity (based on CVE-2025-67641, severity decreased from "High" to "Medium") CVSSv3 score source (changed from "CVE-2025-67640" to none) Plugin Feed: 202603021244
Version 1.3 Feb 25, 2026, 1:08 AM IAVM reference Plugin Feed: 202602250108
Version 1.2 Dec 12, 2025, 5:16 PM New Plugin Feed: 202512121716
Version 1.1 Dec 11, 2025, 12:59 PM New Plugin Feed: 202512111259