CVE-2025-53677
BaseFortify
Publication date: 2025-07-09
Last updated on: 2025-11-04
Assigner: Jenkins Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jenkins | xooa | to 0.0.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-256 | The product stores a password in plaintext within resources such as memory or files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Jenkins Xooa Plugin version 0.0.7 and earlier involves the Xooa Deployment Token not being masked on the global configuration form. This means that the token is visible and can be observed or captured by attackers, potentially compromising security.
How can this vulnerability impact me? :
If exploited, attackers could observe and capture the Xooa Deployment Token, which may allow unauthorized access or control over deployments that use this token, leading to potential security breaches or misuse of the deployment environment.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid using Jenkins Xooa Plugin version 0.0.7 or earlier. Upgrade to a later version where the Xooa Deployment Token is properly masked on the global configuration form. Additionally, review and restrict access to the Jenkins global configuration to trusted users only to reduce the risk of token exposure.