PT-2025-14515 · Unknown+1 · Jenkins Monitor-Remote-Job Plugin+1

Zaoui Zakariae · Published 2025-04-02 · Updated 2025-04-17 · CVE-2025-31725

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins monitor-remote-job Plugin version 1.0

Description The issue allows passwords to be stored unencrypted in job config.xml files on the Jenkins controller. These passwords can be viewed by users with Extended Read permission or those who have access to the Jenkins controller file system.

Recommendations For Jenkins monitor-remote-job Plugin version 1.0, consider restricting access to the Jenkins controller file system and limiting Extended Read permissions to minimize the risk of password exposure. As a temporary workaround, avoid storing sensitive passwords in job config.xml files until a secure storage method is implemented.

Fix

Improper Access Control

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-284

CWE-312

CWE-256

Related Identifiers

BDU:2025-03797

CVE-2025-31725

GHSA-G65G-FMCP-4W68

Affected Products

Jenkins

Jenkins Monitor-Remote-Job Plugin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-31725 · Security Note
• https://jenkins.io/security/advisory/2025-04-02/#SECURITY-3539 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03797 · Security Note
• https://osv.dev/vulnerability/CVE-2025-31725 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g65g-fmcp-4w68 · Vendor Advisory
• https://github.com/jenkinsci/monitor-remote-job-plugin · Note
• https://twitter.com/dailycve/status/1912901177492099572 · Twitter Post
• https://twitter.com/CVEnew/status/1907551232597831727 · Twitter Post
• https://t.me/cvetracker/20594 · Telegram Post
• https://plugins.jenkins.io/monitor-remote-job · Note
• https://t.me/cvedetector/21875 · Telegram Post
• https://jenkins.io/security/advisory/2025-04-02/#SECURITY-3513 · Note