PT-2025-35782

CVE-2025-58460

Publicado

2025-09-03

Atualizado

2025-09-03

Descrição por

CVSS 3.1

4.2

Média

MétricasAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins OpenTelemetry Plugin versions 3.1543.v8446b 92b cd64 and earlier

Description A missing permission check allows attackers with Overall/Read permission to connect to a URL specified by the attacker, using credentials IDs obtained through other means. This can result in the capture of credentials stored in Jenkins.

Recommendations Update to a newer version of the Jenkins OpenTelemetry Plugin.

Explorabilidade

Correção

Impactos

Pesquisadores

Kevin Guerroudj

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-862: Missing Authorization

Identificadores relacionados

CVE-2025-58460