{"id":"CVE-2025-24397","published":"2025-01-22T17:02:51Z","modified":"2025-01-23T16:11:07Z","title":"An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure…","vendor":"Jenkins","product":"Jenkins GitLab Plugin","tier":"tail","description":{"text":"An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00307,"percentile":0.23498,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3260","tags":["vendor-advisory"]}],"priority":{"score":7.7,"factors":[{"name":"EPSS percentile","points":4.7},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins Project","product":"Jenkins GitLab Plugin","versions":["<= 1.9.6"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:gitlab-plugin","vulnerableRanges":["<1.9.7"],"patched":["1.9.7"],"from":["GHSA-xhgq-h98j-859v"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-0210","exploited":false,"provenance":"source"}}