CVE-2025-47888

5.9 mediumEPSS 0.2%

Medium (5.9) in jenkins dingtalk. EPSS 0.2% chance of exploitation in the next 30 days.

Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.

Severity

CVSS 3.1

5.9 medium

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2025-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:dingtalk

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-cp9r-g575-xc5f	Maven	io.jenkins.plugins:dingding-notifications	<=2.7.3	no fix published

References

https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3353

Check your stack JSON