4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59475

CVE-2025-59475: Jenkins is missing a permission check in the authenticated users' profile menu

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu. This allows attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).

Jenkins 2.528, LTS 2.516.3 requires Overall/Read permission to list various items in authenticated user profile dropdown menus.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59475

CVE-2025-59475:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.main:jenkins-core	maven	< 2.516.3	2.516.3
org.jenkins-ci.main:jenkins-core	maven	>= 2.517, < 2.528	2.528

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described in CVE-2025-59475 lies in the user profile dropdown menu where a permission check was missing. This allowed users without Overall/Read permission to view menu items, leading to information disclosure about the Jenkins instance's configuration (e.g., installed plugins).

My analysis started by examining the security advisory and identifying the fixing commits 6bdea9f44a2692b344096ff5ee715adad75e8e02 and eba9ecd21d1e5dbe77e22a656212a46c33a56e08. The patch was not in a Java file but in a Jelly template: core/src/main/resources/jenkins/model/navigation/UserAction/jumplist.jelly. The fix involves wrapping the iteration of user actions within a permission check (<j:if test="${app.hasPermission(app.READ)}">).

While the vulnerability is technically in the view (the Jelly file), a runtime profile would show the Java methods that are executed to render that view. The template iterates over ${it.actions}, which translates to a call to the getActions() method on a UserAction object. This method is responsible for providing the list of actions that are then rendered in the dropdown. Therefore, jenkins.model.navigation.UserAction.getActions is the most relevant function to identify as vulnerable, as it's the source of the information being disclosed. The confidence is marked as medium because the root cause is the lack of a check in the view, not a flaw within the getActions method itself, but its output is what is exposed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.