Jenkins Plugin Vulnerabilities: CVE-2025-58458, 7962, 58459, 58460 Advisory

Critical Vulnerability Information 1. Git client Plugin Vulnerability CVE: CVE-2025-58458 Severity: Medium (CVSS: Medium) Affected Plugin: git-client Description: Git client Plugin versions 6.3.2 and earlier allow the use of the experimental protocol in conjunction with the bundled Git library. This protocol authenticates files based on content from Amazon S3, where the file path is provided as part of the URL's authority section. Fix: Upgrade to version 6.3.3 2. Jakarta Mail API Plugin Vulnerability CVE: CVE-2025-7962 Severity: Medium (CVSS: Medium) Affected Plugin: jakarta-mail-api Description: Jakarta Mail API Plugin versions 2.1.3-2 and earlier bundle a version of Angus Mail that is vulnerable to CVE-2025-7962. Fix: Upgrade to version 2.1.3-3 3. global-build-stats Plugin Vulnerability CVE: CVE-2025-58459 Severity: Medium (CVSS: Medium) Affected Plugin: global-build-stats Description: global-build-stats Plugin versions 322.v22f4db_1Be2ddd and earlier do not perform permission checks on REST API endpoints. Fix: Upgrade to version 347.v322a_eb_0493c4f 4. OpenTelemetry Plugin Vulnerability CVE: CVE-2025-58460 Severity: Medium (CVSS: Medium) Affected Plugin: opentelemetry Description: OpenTelemetry Plugin versions 3.1543.v8446b_92b_c6d5 and earlier do not perform permission checks in methods implementing form validation. Fix: Upgrade to version 3.1543.1545.vf5a_4ec123769

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Vulnerabilities: CVE-2025-58458, 7962, 58459, 58460 Advisory