CVE-2025-64136: Jenkins Themis Plugin Cross-Site Request Forgery Vulnerability
Summary
CVE-2025-64136: Jenkins Themis Plugin vulnerable to cross-site request forgery. Affects org.jenkins-ci.plugins:themis versions < 1.4.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Themis Plugin is an integration tool designed to enhance Jenkins' capabilities by providing additional functionalities for managing and securing builds. It allows users to connect to external services and manage permissions effectively. However, the plugin has been identified to have a critical security flaw that exposes it to cross-site request forgery (CSRF) attacks, particularly affecting versions 1.4.1 and earlier.
Vulnerability Detail
The Jenkins Themis Plugin versions 1.4.1 and earlier lack a proper permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to connect to any URL specified by the attacker. This vulnerability is exacerbated by the fact that the endpoint does not enforce POST requests, making it susceptible to CSRF attacks. As a result, an attacker could exploit this vulnerability to perform unauthorized actions on behalf of a user without their consent, potentially leading to data exposure or manipulation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Jenkins instance to trusted networks and ensure that users with Overall/Read permissions are aware of the risks associated with this vulnerability. Additionally, implementing CSRF protection measures at the application level can help mitigate the risk until a patch is released.
Conclusion
The Jenkins Themis Plugin is currently vulnerable to a CSRF attack due to insufficient permission checks in its HTTP endpoint. Users are advised to monitor for updates and apply patches as they become available. In the meantime, implementing workarounds and security measures can help mitigate potential risks.
See every vulnerability recorded for org.jenkins-ci.plugins:themis →
FAQ
The Jenkins Themis Plugin is a tool that enhances Jenkins' functionality by allowing integration with external services and managing permissions.
A CSRF vulnerability allows an attacker to perform actions on behalf of a user without their consent, potentially leading to unauthorized access or data manipulation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using your pom.xml file, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, consider restricting access to your Jenkins instance and implementing additional security measures to mitigate the risk.
The CVSS score for this vulnerability is 4.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:themis.
