CVE-2025-64133NVD

Vulnerability Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.

Severity Level

MEDIUM(5.4)

Published Date

Oct 29, 2025

Last Modified

Oct 29, 2025

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

Data Pending

Root Weakness (CWE)

CWE-352: Cross-Site Request Forgery (CSRF) ↗

The web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVSS v3.1 Base Metrics — Score 5.4 (MEDIUM)

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionRequired

ScopeUnchanged

ConfidentialityNone

IntegrityLow

AvailabilityLow

Affected & Patched Versions

Affected Versions

Not provided by NVD for this CVE.

Patched Versions

Not provided by NVD for this CVE.

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.