CVE-2025-53661
BaseFortify
Publication date: 2025-07-09
Last updated on: 2025-11-04
Assigner: Jenkins Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jenkins | testsigma_test_plan_run | to 1.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Jenkins Testsigma Test Plan run Plugin version 1.6 and earlier involves the plugin not masking Testsigma API keys on the job configuration form. As a result, these API keys are visible and can be observed or captured by attackers.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access if attackers observe or capture the exposed Testsigma API keys. This could allow attackers to misuse the API keys to perform unauthorized actions or access sensitive data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid using Jenkins Testsigma Test Plan run Plugin version 1.6 or earlier until a fixed version is available. Review job configuration forms for exposed Testsigma API keys and rotate any keys that may have been exposed. Limit access to Jenkins job configurations to trusted users only.