4.3

CVSS Score

3.1

Basic Information

CVE ID

CVE-2025-64137

GHSA ID

GHSA-jwm4-955w-4hj3

EPSS Score

CWE

CWE-862

Published

10/29/2025

Updated

10/29/2025

KEV Status

Technology

Java

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64137

CVE-2025-64137: Jenkins Themis Plugin is missing a permission check

Jenkins Themis Plugin 1.4.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

(GitHub Advisory)

4.3

CVSS Score

3.1

Basic Information

CVE ID

CVE-2025-64137

GHSA ID

GHSA-jwm4-955w-4hj3

EPSS Score

CWE

CWE-862

Published

10/29/2025

Updated

10/29/2025

KEV Status

Technology

Java

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:themis	maven	<= 1.4.1

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

J*nkins T**mis Plu*in *.*.* *n* **rli*r *o*s not p*r*orm * p*rmission ****k in *n *TTP *n*point. T*is *llows *tt**k*rs wit* Ov*r*ll/R*** p*rmission to *onn**t to *n *tt**k*r-sp**i*i** URL. ***ition*lly, t*is *n*point *o*s not r*quir* POST r*qu*sts,

Reasoning

No *n*lysis *v*il**l*

4.3

Basic Information

Concerned about an active attack path?

CVE-2025-64137: Jenkins Themis Plugin is missing a permission check

4.3

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI