Security Advisory

CVE-2025-24397

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-01-22 17:02:51

Last updated 2025-01-23 16:11:07

Assigner jenkins

State PUBLISHED

Description

An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins.

← Browse all CVEs View on cve.org ↗