PT-2025-14517 · Jenkins · Jenkins Asakusasatellite Plugin+1

Romuald Moisan + 1 · Published 2025-04-02 · Updated 2025-04-17 · CVE-2025-31727

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins AsakusaSatellite Plugin versions 0.1.1 and earlier

Description The issue concerns the storage of AsakusaSatellite API keys in an unencrypted manner within job config.xml files on the Jenkins controller. This allows users with Item/Extended Read permission or access to the Jenkins controller file system to view these keys.

Recommendations For Jenkins AsakusaSatellite Plugin versions 0.1.1 and earlier, consider restricting access to the Jenkins controller file system and limiting Item/Extended Read permissions to minimize exposure of the unencrypted AsakusaSatellite API keys until a fix is available.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-549

Related Identifiers

BDU:2025-03849

CVE-2025-31727

GHSA-FV9Q-FQ62-C6QG

Affected Products

Jenkins

Jenkins Asakusasatellite Plugin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-31727 · Security Note
• https://osv.dev/vulnerability/GHSA-fv9q-fq62-c6qg · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03849 · Security Note
• https://jenkins.io/security/advisory/2025-04-02/#SECURITY-3523 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-31727 · Vendor Advisory
• https://github.com/jenkinsci/asakusa-satellite-plugin · Note
• https://plugins.jenkins.io/asakusa-satellite-plugin · Note
• https://t.me/cvedetector/21876 · Telegram Post
• https://t.me/cvetracker/20596 · Telegram Post
• https://twitter.com/dailycve/status/1912900565207523809 · Twitter Post
• https://twitter.com/CVEnew/status/1907551230689505417 · Twitter Post
• https://jenkins.io/security/advisory/2025-04-02 · Note