CVE-2025-31720

Description

A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.

Reserved 2025-04-01 | Published 2025-04-02 | Updated 2025-04-02 | Assigner jenkins

Product status

Default status
affected

2.492.3 before 2.492.*
unaffected

2.504 before *
unaffected

References

www.jenkins.io/security/advisory/2025-04-02/ (Jenkins Security Advisory 2025-04-02) vendor-advisory

cve.org (CVE-2025-31720)

nvd.nist.gov (CVE-2025-31720)

Download JSON