.png){kind=logo}
Executive Summary
March 5, 2025 - A new vulnerability identified as CVE-2025-27622 has been discovered within Jenkins, a widely utilized open-source automation server, impacting both CI/CD processes. This flaw, disclosed in a Jenkins security advisory, affects Jenkins versions 2.499 and earlier, as well as LTS versions 2.492.1 and earlier. The vulnerability results from improper redaction of encrypted secrets within agent and view configurations. Attackers with specific permissions can exploit this to access sensitive information.
Technical Information
CVE-2025-27622 is classified as a Cleartext Storage of Sensitive Information vulnerability, identified under CWE-312. The primary component affected is the Jenkins core system. Attackers utilizing Agent/Extended Read permissions can leverage this weakness to extract encrypted secrets from the
The Jenkins automation server, pivotal in CI/CD frameworks, facilitates the management of code integration and deployment processes. This vulnerability, if left unaddressed, poses a significant risk by potentially exposing sensitive credentials used in various workflows. The repercussions of unauthorized access in such environments are considerable, as they may lead to further exploitation of the CI/CD pipelines.
Jenkins has been a cornerstone in modern software development practices, enabling automated testing, building, and deployment. The improper redaction of secrets within configurations underscores the critical need for robust secrets management. Ensuring that sensitive information remains confidential is paramount, and any lapse can jeopardize the integrity and security of an organization's software delivery mechanisms.
Exploitation in the Wild
At present, there are no confirmed reports of this vulnerability being actively exploited in the wild. Nonetheless, the exposure of encrypted secrets within Jenkins environments remains a potential threat. Given the nature of CI/CD workflows, where credentials and secrets are frequently utilized, the risk of unauthorized access can have cascading effects on the security of the entire software development lifecycle.
APT Groups using this vulnerability
There are currently no known Advanced Persistent Threat (APT) groups exploiting this particular vulnerability. However, the cybersecurity landscape is ever-evolving, and the potential for exploitation remains as threat actors continuously seek opportunities to compromise systems.
Affected Product Versions
This vulnerability impacts Jenkins versions 2.499 and earlier, along with LTS versions 2.492.1 and earlier. Users operating these versions are urged to take immediate action to safeguard their environments.
Workaround and Mitigation
Organizations should prioritize upgrading to Jenkins version 2.500 (weekly) or 2.492.2 (LTS) to apply the necessary security patches. For environments where immediate upgrading is not feasible, reviewing and restricting permissions for roles with Agent/Extended Read or View/Read access is crucial. Temporary mitigations may include revoking unnecessary permissions and implementing reverse proxy rules to block unauthorized access patterns. It is imperative that only authorized users have access to sensitive configurations to mitigate risks associated with this vulnerability.
References
For further reading and official advisories, please refer to the following resources: Jenkins Security Advisory: https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3495 NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-27622 GBHackers Report: https://gbhackers.com/multiple-jenkins-vulnerabilities/
Rescana is here for you
At Rescana, we understand the complexities of managing third-party risks and the importance of maintaining secure CI/CD environments. Our Third Party Risk Management (TPRM) platform is designed to help organizations identify, assess, and mitigate risks associated with external vendors and technologies. By leveraging our platform, businesses can enhance their security posture and ensure that vulnerabilities like CVE-2025-27622 are addressed promptly.
We are committed to supporting our clients in navigating the cybersecurity landscape and are available to answer any questions you may have about this report or other security concerns. Please reach out to us at ops@rescana.com for further assistance.