GHSA-3jw2-5hjg-hc2cMediumCVSS 5.4

Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery

Published
October 29, 2025
Last Modified
November 5, 2025

🔗 CVE IDs covered (1)

CVE-2025-64133 →

📋 Description

Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to execute sandboxed Groovy code.

As of publication of this advisory, there is no fix.

🎯 Affected products1

  • maven/jp.ikedam.jenkins.plugins:extensible-choice-parameter:<= 239.v5f5c278708cf

🔗 References (4)