CVE-2025-53743
BaseFortify
Publication date: 2025-07-09
Last updated on: 2025-11-04
Assigner: Jenkins Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jenkins | applitools_eyes | to 1.16.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Jenkins Applitools Eyes Plugin version 1.16.5 and earlier involves the plugin not masking Applitools API keys on the job configuration form, which means these keys are visible and can be observed or captured by attackers.
How can this vulnerability impact me? :
If an attacker observes or captures the exposed Applitools API keys, they could potentially misuse these keys to access Applitools services or data, leading to unauthorized actions or data exposure.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Jenkins Applitools Eyes Plugin to a version later than 1.16.5 where the API keys are properly masked. Additionally, avoid exposing API keys in job configuration forms and rotate any potentially exposed API keys to prevent unauthorized access.