Stapler, a component of Jenkins, improperly embeds the CSRF token (crumb) as a string literal in dynamically generated JavaScript resources. This flaw allows an attacker who can host a malicious page on the same domain as Jenkins to read the token and subsequently perform any actions that the authenticated user is authorized to perform, effectively hijacking the user's session. The vulnerability is a cross‑site request forgery (CSRF) flaw, identified as CWE‑352, and can lead to arbitrary configuration changes, the execution of builds, or other privileged operations on the target Jenkins instance.

The issue impacts the Stapler component in Jenkins versions 2.447 through 2.579 inclusive and LTS releases 2.452.1 through 2.568.2 inclusive, excluding the specific release 2088.2093.vd7c3e58008a_6. It applies to Stapler releases starting with 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317, both inclusive, except for 2088.2093.vd7c3e58008a_6. All affected deployments are produced by the Jenkins Project.

The CVSS score of 8.8 indicates a high severity vulnerability. EPSS data is not available, so no definitive exploitation probability can be cited, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web-based exploit where an attacker hosts a malicious page on the same site as Jenkins, uses JavaScript to read the exposed token, and then performs privileged actions as the victim. The lack of an EPSS score or KEV listing suggests that while the vulnerability is severe, the current observed exploitation activity may be limited or untracked.