CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NCVE-2025-24400
Medium (4.3) in jenkins eiffel broadcaster. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in com.axis.jenkins.plugins.eiffel:eiffel-broadcaster 2.10.3.
Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers able to create a credential with the same ID as a legitimate one in a different credentials store to sign an event published to RabbitMQ with the legitimate credentials.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:eiffel_broadcaster
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fpw7-8gjc-jwqj | Maven | com.axis.jenkins.plugins.eiffel:eiffel-broadcaster | >=2.8.0 <2.10.3 | 2.10.3 |