CVE-2025-53674
BaseFortify
Publication date: 2025-07-09
Last updated on: 2025-11-04
Assigner: Jenkins Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jenkins | sensedia_api_platform_tools | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-256 | The product stores a password in plaintext within resources such as memory or files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Jenkins Sensedia Api Platform tools Plugin 1.0, where the Sensedia API Manager integration token is not masked on the global configuration form. This means that the token is visible and can be observed or captured by attackers who have access to the form.
How can this vulnerability impact me? :
If an attacker observes or captures the unmasked integration token, they could potentially use it to gain unauthorized access to the Sensedia API Manager, leading to data exposure, manipulation, or other malicious activities.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid exposing the Sensedia API Manager integration token by restricting access to the Jenkins Sensedia Api Platform tools Plugin global configuration form. Ensure that only trusted administrators can view or modify this configuration. Consider rotating the integration token if it may have been exposed.