A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.492.3 or Jenkins weekly prior to 2.504. It is, therefore, affected by multiple vulnerabilities:

  - A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with     Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to     encrypted secrets in its configuration. (CVE-2025-31721)

  - A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with     Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access     to its configuration. (CVE-2025-31720)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2025-31721

medium

Tenable Plugins

medium