5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59474

CVE-2025-59474: Jenkins has a missing permission check, allowing users to obtain agent names

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission.

This allows attackers without Overall/Read permission to list agent names through its sidepanel executors widget.

Jenkins 2.528, LTS 2.516.3 removes the sidepanel from the affected view.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59474

CVE-2025-59474:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.main:jenkins-core	maven	< 2.516.3	2.516.3
org.jenkins-ci.main:jenkins-core	maven	>= 2.517, < 2.528	2.528

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of Missing Authorization (CWE-862) within the view layer of the application. The core issue lies in the Jelly templates responsible for rendering the Jenkins side panel. These templates failed to check for Overall/Read permission before rendering sensitive information.

The investigation of the patch reveals two main points of failure:

The generic side panel template (hudson/model/View/sidepanel.jelly) rendered its widgets, including the 'Build Executor Status' widget which lists agent names, without checking permissions. The patch rectifies this by wrapping the widget rendering logic in a permission check.
The user signup page (hudson/security/SecurityRealm/signup.jelly), which is accessible to unauthenticated users, improperly included this vulnerable side panel. The patch fixes this by removing the side panel from this specific page.

Consequently, the vulnerable functions identified are the Java methods that are invoked during the rendering of these unprotected UI components. A runtime profiler would capture calls to hudson.model.View.getWidgets() to get the list of widgets, and subsequently, methods on those widgets like hudson.widgets.ExecutorsWidget.getComputers() to fetch the agent data. Additionally, hudson.security.SecurityRealm.doSignup is identified as a vulnerable entry point as it leads to the rendering of the compromised signup page.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.