CVE-2025-53665
BaseFortify
Publication date: 2025-07-09
Last updated on: 2025-11-04
Assigner: Jenkins Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jenkins | apica_loadtest | to 1.10 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-256 | The product stores a password in plaintext within resources such as memory or files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Jenkins Apica Loadtest Plugin version 1.10 and earlier involves the plugin not masking Apica Loadtest LTP authentication tokens on the job configuration form. This means that these sensitive tokens are visible and can be observed or captured by attackers.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access if attackers observe or capture the exposed authentication tokens. This could allow attackers to misuse the tokens to perform unauthorized actions within the Apica Loadtest environment.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the Jenkins Apica Loadtest Plugin to a version later than 1.10 where the issue is fixed, or avoid using the plugin until a fix is available. Additionally, review job configuration forms for exposed authentication tokens and restrict access to Jenkins job configurations to trusted users only.