PT-2025-14518 · Jenkins · Jenkins Asakusasatellite Plugin+1

Published 2025-04-02 · Updated 2025-04-02 · CVE-2025-31728

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins AsakusaSatellite Plugin versions 0.1.1 and earlier

Description The issue concerns the exposure of AsakusaSatellite API keys on the job configuration form, which could allow attackers to observe and capture them.

Recommendations For Jenkins AsakusaSatellite Plugin versions 0.1.1 and earlier, consider masking AsakusaSatellite API keys displayed on the job configuration form to prevent potential attackers from observing and capturing them. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-549

Related Identifiers

BDU:2025-03847

CVE-2025-31728

GHSA-M254-F6H4-P93G

Affected Products

Jenkins

Jenkins Asakusasatellite Plugin

References · 11

• https://jenkins.io/security/advisory/2025-04-02/#SECURITY-3523 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m254-f6h4-p93g · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03847 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-31728 · Security Note
• https://osv.dev/vulnerability/CVE-2025-31728 · Vendor Advisory
• https://github.com/jenkinsci/asakusa-satellite-plugin · Note
• https://twitter.com/CVEnew/status/1907551229280137549 · Twitter Post
• https://plugins.jenkins.io/asakusa-satellite-plugin · Note
• https://jenkins.io/security/advisory/2025-04-02 · Note
• https://t.me/cvedetector/21878 · Telegram Post
• https://t.me/cvetracker/20597 · Telegram Post