← Back

CVE-2025-31727

nvd nist
Published: Apr 2, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Exploitability: 2.1 / Impact: 3.4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Affected (1)

Jenkins
1 product
Asakusasatellite
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Asakusasatellite
Up to 0.1.1

Related CWEs

CWE-549
Missing Password Field Masking
The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

References (1)

Source: jenkinsci-cert@googlegroups.com
Vendor Advisory

Timeline

No history available yet.