CVE-2025-53652

Published Jul 9, 2025

Last updated 2 months ago

Jenkins Git Parameter Plugin

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-53652 is a security vulnerability in the Jenkins Git Parameter Plugin, affecting versions 439.vb0e46ca14534 and earlier. The vulnerability arises because the plugin fails to validate that the Git parameter value submitted to the build matches one of the offered choices. This missing input validation allows attackers with Item/Build permission to inject arbitrary values into Git parameters. The vulnerability can enable attackers to bypass intended restrictions on Git parameter values. This could lead to unauthorized access to Git resources or potential manipulation of build processes. The vulnerability has been fixed in Git Parameter Plugin version 444.vcab84d3703c2, which implements proper validation to ensure that the Git parameter value submitted to the build matches one of the offered choices.

Description: Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with Item/Build permission to inject arbitrary values into Git parameters.
Source: jenkinsci-cert@googlegroups.com
NVD status: Analyzed
Products: git_parameter

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.2
Impact score: 4.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:jenkins:git_parameter:*:*:*:*:*:jenkins:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B13D3F26-3F64-4185-8560-213AA36DF7E6",
            "versionEndExcluding": "444.vca_b_84d3703c2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.