PT-2025-28907 · Jenkins · Jenkins Statistics Gatherer Plugin+1

Romuald Moisan · Published 2025-07-09 · Updated 2025-07-18 · CVE-2025-53655

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier

Description: The Jenkins Statistics Gatherer Plugin does not mask the AWS Secret Key on the global configuration form and stores it unencrypted in the org.jenkins.plugins.statistics.gatherer.StatisticsConfiguration.xml configuration file on the Jenkins controller. This allows users with access to the Jenkins controller file system to view the key, and increases the potential for attackers to observe and capture it.

Recommendations: For versions prior to 2.0.3, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-256

Related Identifiers

BDU:2025-08321

CVE-2025-53655

GHSA-26X3-7JW5-7MG4

Affected Products

Jenkins

Jenkins Statistics Gatherer Plugin

References · 12

• https://osv.dev/vulnerability/CVE-2025-53655 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08321 · Security Note
• https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3554 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-26x3-7jw5-7mg4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53655 · Security Note
• https://github.com/jenkinsci/statistics-gatherer-plugin · Note
• https://t.me/cvenotify/129482 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1943100518865256658 · Twitter Post
• https://twitter.com/CVEnew/status/1943335919437643864 · Twitter Post
• https://t.me/cvenotify/128206 · Telegram Post
• https://jenkins.io/security/advisory/2025-07-09 · Note
• http://openwall.com/lists/oss-security/2025/07/09/4 · Note