PT-2025-35782

CVE-2025-58460

Published

2025-09-03

Updated

2025-09-03

Description by

CVSS 3.1

4.2

Medium

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins OpenTelemetry Plugin versions 3.1543.v8446b 92b cd64 and earlier

Description A missing permission check allows attackers with Overall/Read permission to connect to a URL specified by the attacker, using credentials IDs obtained through other means. This can result in the capture of credentials stored in Jenkins.

Recommendations Update to a newer version of the Jenkins OpenTelemetry Plugin.

Exploitability

Fix

Impacts

Researchers

Kevin Guerroudj

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers

CVE-2025-58460