Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-47888
CVE-2025-47888:
Java vulnerability analysis and mitigation
Overview
The vulnerability CVE-2025-47888 affects the Jenkins DingTalk Plugin versions 2.7.3 and earlier. This security flaw was discovered by Pierre Beitz from CloudBees, Inc. and was publicly disclosed on May 14, 2025. The vulnerability involves the plugin's handling of SSL/TLS certificate validation for DingTalk webhook connections (Jenkins Advisory, NVD).
Technical details
The vulnerability stems from the DingTalk Plugin unconditionally disabling SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks. The issue has been assigned a Medium severity rating according to CVSS metrics. The vulnerability is tracked under the identifier SECURITY-3353 in Jenkins' security tracking system (Jenkins Advisory).
Impact
The disabling of SSL/TLS certificate and hostname validation makes the plugin's connections vulnerable to Man-in-the-Middle (MITM) attacks. This security weakness could allow attackers to intercept, monitor, or manipulate the communication between Jenkins and DingTalk webhooks (Security Online).
Mitigation and workarounds
As of the publication of the security advisory on May 14, 2025, no fix is available for this vulnerability. Users of the affected plugin should consider implementing network-level security controls to protect webhook communications until a patch is released (Jenkins Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management