Jenkins Gatling Plugin 136.vb_9009b_3d33a_e Content-Security-Policy protection mechanism

Summaryinfo

A vulnerability has been found in Jenkins Gatling Plugin 136.vb_9009b_3d33a_e and classified as problematic. This vulnerability affects unknown code of the component Content-Security-Policy Handler. This manipulation causes protection mechanism. This vulnerability is registered as CVE-2025-5806. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as problematic was found in Jenkins Gatling Plugin 136.vb_9009b_3d33a_e. Affected by this vulnerability is an unknown part of the component Content-Security-Policy Handler. The manipulation with an unknown input leads to a protection mechanism vulnerability. The CWE definition for the vulnerability is CWE-693. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. As an impact it is known to affect integrity. The summary by CVE is:

Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to change report content.

The advisory is shared at jenkins.io. This vulnerability is known as CVE-2025-5806 since 06/06/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/09/2025).

The vulnerability scanner Nessus provides a plugin with the ID 237910 (Jenkins plugin (2025-06-06)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (237910) and EUVD (EUVD-2025-17299). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Continuous Integration Software

Vendor

• Jenkins

Name

• Gatling Plugin

Version

• 136.vb_9009b_3d33a_e

License

• open-source

Website

• Vendor: https://jenkins.io/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion