CVE-2025-58459 json
Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated
published 2025-09-03 14 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-26515 , GHSA-gm8g-fh49-qq6v
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.
Patch / fix
- maven org.jenkins-ci.plugins:global-build-stats 347.v32a
- jenkins global-build-stats 347.v32a_eb_0493c4f
- jenkins global_build_stats 347.v32a_eb_0493c4f
- org.jenkins-ci.plugins global-build-stats 347.v32a_eb_0493c4f
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:global-build-stats | <347.v32a |
347.v32a |
Affected products
- Jenkins Project Jenkins global-build-stats Plugin
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/jenkinsci/global-build-stats-plugin/commit/32aeb0493c4ff5423448576f477ac612f7a25138
web
-
jenkins.io
/security/advisory/2025-09-03/#SECURITY-3535
vendor-advisory, web
-
openwall.com
/lists/oss-security/2025/09/03/4
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-58459
advisory
-
github.com
/jenkinsci/global-build-stats-plugin
package
Sources
- CVE List CVE-2025-58459
- GitHub Advisory GHSA-gm8g-fh49-qq6v
- NVD CVE-2025-58459
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.