Loading...
Skip to main content
GeekWala

CVE-2025-64140 — Vulnerability in org.jenkins-ci.plugins:azure-cli...

HIGH

Jenkins Azure CLI Plugin does not restrict the commands it executes

Published October 29, 2025Updated November 5, 2025Source: osv

Summary

Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller. This allows attackers with Item/Configure permission to execute arbitrary shell commands on the Jenkins controller. As of publication of this advisory, there is no fix.

Advisory Timeline

  • First published October 29, 2025 (348 days ago).
  • Last revised November 5, 2025 — 7 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.jenkins-ci.plugins:azure-cli
maven
0.1, 0.2, 0.3, 0.4 (+5 more)Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-78
    OS Command InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-64140?
Jenkins Azure CLI Plugin does not restrict the commands it executes This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2025-64140?
CVE-2025-64140 affects org.jenkins-ci.plugins:azure-cli. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-64140 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-rh72-238f-g26q

Related CVEs

  • CVE-2020-2279
    CRITICAL

    Sandbox bypass vulnerability in Jenkins Script Security Plugin

  • CVE-2022-43403
    CRITICAL

    Jenkins Script Security Plugin sandbox bypass vulnerability

  • CVE-2023-24443
    CRITICAL

    XML Entity Expansion in Jenkins TestComplete support Plugin

  • CVE-2023-24430
    CRITICAL

    XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin

  • CVE-2022-43402
    CRITICAL

    Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution

  • CVE-2026-57296
    HIGH

    Jenkins External Workspace Manager Plugin has a path traversal vulnerability

  • CVE-2026-48920
    HIGH

    Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem

  • CVE-2025-47889
    HIGH

    Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies