CVE-2025-58459: 
Java vulnerability analysis and mitigation

Jenkins global-build-stats Plugin version 322.v22f4db_18e2dd and earlier contains a security vulnerability identified as CVE-2025-58459. The vulnerability was discovered and reported by Daniel Beck from CloudBees, Inc., and was publicly disclosed on September 3, 2025. This medium severity vulnerability affects the Jenkins global-build-stats Plugin, which is a component used for build statistics visualization in Jenkins installations (Jenkins Advisory).

The vulnerability stems from missing permission checks in the plugin's REST API endpoints. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-284 (Improper Access Control) (NVD).

When exploited, this vulnerability allows attackers with Overall/Read permission to enumerate graph IDs within the Jenkins installation. These enumerated IDs can subsequently be used to access the corresponding graphs, potentially exposing sensitive build statistics information (Jenkins Advisory).

The vulnerability has been fixed in global-build-stats Plugin version 347.v32aeb0493c4f. The updated version implements proper permission checks by requiring Overall/Administer permission to access its REST API endpoints. Users are strongly advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).