CVE-2025-58459

Description

Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.

PUBLISHED Reserved 2025-09-02 | Published 2025-09-03 | Updated 2025-09-03 | Assigner jenkins

Product status

References

www.jenkins.io/security/advisory/2025-09-03/ (Jenkins Security Advisory 2025-09-03) vendor-advisory

cve.org (CVE-2025-58459)

nvd.nist.gov (CVE-2025-58459)

Download JSON