CVE-2025-64137: Jenkins Themis Plugin Lacks Permission Check Leading to CSRF Vulnerability
Summary
CVE-2025-64137: Jenkins Themis Plugin is missing a permission check. Affects org.jenkins-ci.plugins:themis versions < 1.4.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Themis Plugin is an extension for Jenkins, a widely-used open-source automation server that facilitates continuous integration and continuous delivery (CI/CD). This plugin is designed to enhance security by managing permissions and access controls. However, versions 1.4.1 and earlier are susceptible to a significant vulnerability due to inadequate permission checks in an HTTP endpoint, which can be exploited by attackers.
Vulnerability Detail
The Jenkins Themis Plugin versions 1.4.1 and earlier do not implement a necessary permission check for a specific HTTP endpoint. This oversight allows any user with Overall/Read permission to connect to an attacker-specified URL, potentially leading to unauthorized access and data exposure. Furthermore, the endpoint does not enforce POST requests, creating a cross-site request forgery (CSRF) vulnerability that could be exploited to perform actions on behalf of the user without their consent.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk of exploitation, it is recommended to restrict access to the Jenkins instance and limit the Overall/Read permissions to trusted users only. Additionally, consider implementing CSRF protection measures at the application level.
Conclusion
The Jenkins Themis Plugin vulnerability (CVE-2025-64137) poses a significant risk due to its lack of permission checks and susceptibility to CSRF attacks. Users are urged to monitor for updates and implement access restrictions to mitigate potential threats.
See every vulnerability recorded for org.jenkins-ci.plugins:themis →
FAQ
The Jenkins Themis Plugin is a security extension for Jenkins that helps manage user permissions and access controls within the CI/CD environment.
The vulnerability allows users with Overall/Read permissions to access an HTTP endpoint without proper checks, leading to potential unauthorized actions and CSRF attacks.
As of now, there is no patch available. Users should keep an eye on the plugin's repository for any updates.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 4.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:themis.
