CVE-2025-64147

Published: Oct 29, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Affected (1)

Products: Jenkins: Curseforge Publisher

Jenkins

1 product

Curseforge Publisher

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Curseforge Publisher	Version 1.0

Related CWEs

CWE-311

Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

References (2)

https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3562

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2025/10/29/2

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.