CVE-2025-53654
BaseFortify
Publication date: 2025-07-09
Last updated on: 2025-11-04
Assigner: Jenkins Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jenkins | statistics_gatherer | to 2.0.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in Jenkins Statistics Gatherer Plugin version 2.0.3 and earlier, where the AWS Secret Key is stored unencrypted in the plugin's global configuration file on the Jenkins controller. This means that any user who has access to the Jenkins controller's file system can view the AWS Secret Key in plain text.
How can this vulnerability impact me? :
If an attacker or unauthorized user gains access to the Jenkins controller file system, they can retrieve the AWS Secret Key stored unencrypted. This could lead to unauthorized access to AWS resources, potentially resulting in data breaches, resource misuse, or other security incidents.