← Database

CVE-2025-24397

MEDIUM CVSS: 4.3 Published: 2025-01-22 Modified: 2026-06-17

Description

An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins.

Affected Platforms

Jenkins Gitlab

Weakness Type

CWE-863

References