PT-2025-45664

Published

2025-10-29

·

Updated

2025-10-29

Description by

CVSS 3.1
5.4
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to execute sandboxed Groovy code.
As of publication of this advisory, there is no fix.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-352: Cross-Site Request Forgery (CSRF)
Related identifiers
GHSA-3JW2-5HJG-HC2C
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com