Vulnerability Details CVE-2025-24400
Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers able to create a credential with the same ID as a legitimate one in a different credentials store to sign an event published to RabbitMQ with the legitimate credentials.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 18.8%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2025-24400
-
cpe:2.3:a:jenkins:eiffel_broadcaster:2.10.2
-
cpe:2.3:a:jenkins:eiffel_broadcaster:2.8.0