← Database

CVE-2025-27622

MEDIUM CVSS: 4.3 Published: 2025-03-05 Modified: 2026-06-17

Description

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets.

Affected Platforms

Jenkins Jenkins

Weakness Type

CWE-312

References