CVE-2025-53652

CWE-20 — Improper Input ValidationCWE-12875 documents5 sources
Severity
8.2HIGH
EPSS
0.1%
top 84.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins GIT ParameterJenkins Project Jenkins GIT Parameter Plugin
Timeline
PublishedJul 9

Description

Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with Item/Build permission to inject arbitrary values into Git parameters.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NExploitability: 3.9 | Impact: 4.2

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_git_parameter_plugin439.vb_0e46ca_14534
▶NVDjenkins/git_parameter< 444.vca_b_84d3703c2

🔴Vulnerability Details

3
CVEList
CVE-2025-53652: Jenkins Git Parameter Plugin 439↗2025-07-09
▶
OSV
Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check↗2025-07-09
▶
GHSA
Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check↗2025-07-09
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2025-07-09↗2025-07-09
▶
CVE-2025-53652 (HIGH CVSS 8.2) | Jenkins Git Parameter Plugin 439.vb | cvebase.io