CVE-2025-24397 Incorrect permission check in Jenkins GitLab Plugin allows enumerating credentials IDs
Attackers with global configure permissions can enumerate GitLab API token and secret text credential IDs in Jenkins.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-24397?
CVE-2025-24397 is a medium-severity vulnerability in Jenkins GitLab Plugin, published on 22 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins.
Weakness: CWE-863
Which versions are affected by CVE-2025-24397?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:gitlab-plugin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:gitlab-plugin Maven | All versions | 1.9.7 |
org.jenkins-ci.plugins:gitlab-plugin Maven | All versions | 1.9.7 |
Products include Jenkins Gitlab.
How do I fix CVE-2025-24397?
Upgrade org.jenkins-ci.plugins:gitlab-plugin to 1.9.7 or later.
Is CVE-2025-24397 being exploited?
There is no known exploitation of CVE-2025-24397 in the wild and no public exploit code.
Other vulnerabilities in Jenkins GitLab Plugin
- CVE-2019-10301 Jenkins GitLab Plugin missing permission checks
- CVE-2019-10300 Jenkins GitLab Plugin Cross-Site Request Forgery vulnerability
- CVE-2022-30955 Missing permission check in Jenkins GitLab Plugin
- CVE-2022-34777 Cross-site Scripting in Jenkins GitLab Plugin
- CVE-2022-43411 Non-constant time webhook token comparison in Jenkins GitLab Plugin
Sources
Also known as GHSA-xhgq-h98j-859v.