CVE-2025-5806

Published Jun 6, 2025

Last updated 2 months ago

Jenkins Gatling Plugin

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-5806 is a cross-site scripting (XSS) vulnerability found in the Jenkins Gatling Plugin version 136.vb_9009b_3d33a_e. The vulnerability arises because the plugin serves Gatling reports in a way that bypasses the Content-Security-Policy (CSP) protections that were introduced in Jenkins versions 1.641 and 1.625. This bypass allows users who can modify report content to inject and execute malicious scripts within the browsers of other users. Successful exploitation could lead to theft of sensitive session cookies, manipulation of page content, unauthorized actions performed on behalf of the victim, and potential compromise of user credentials and sensitive information.

Description: Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to change report content.
Source: jenkinsci-cert@googlegroups.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8
Impact score: 5.9
Exploitability score: 2.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Hype score: Not currently trending

References