PT-2025-28928 · Jenkins · Jenkins Xooa Plugin+1

Romuald Moisan · Publicado 2025-07-09 · Atualizado 2025-07-10 · CVE-2025-53676

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Xooa Plugin versions 0.0.7 and earlier

Description: The Jenkins Xooa Plugin stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller. This allows users with access to the Jenkins controller file system to view the token.

Recommendations: Update to a newer version of the Jenkins Xooa Plugin.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

BDU:2025-08571

CVE-2025-53676

GHSA-56H7-R62C-83QP

Produtos afetados

Jenkins

Jenkins Xooa Plugin

Referências · 9

• https://github.com/jenkinsci/xooa-plugin · Nota
• https://osv.dev/vulnerability/GHSA-56h7-r62c-83qp · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1943041645961715792 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-53676 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-08571 · Nota de Segurança
• https://twitter.com/CVEnew/status/1943335899942584338 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-53676 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3522 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2025/07/09/4 · Nota