PT-2025-28908 · Jenkins · Jenkins Readyapi Functional Testing Plugin+1

Romuald Moisan + 1 · Published 2025-07-09 · Updated 2025-07-18 · CVE-2025-53656

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins ReadyAPI Functional Testing Plugin versions 1.11 and earlier

Description: The Jenkins ReadyAPI Functional Testing Plugin stores sensitive information, including SLM License Access Keys, client secrets, and passwords, in unencrypted format within job config.xml files on the Jenkins controller. This allows users with Item/Extended Read permission or file system access to view these credentials.

Recommendations: Versions prior to 1.11: Ensure that access to the Jenkins controller file system is restricted to authorized personnel only. Limit Item/Extended Read permissions to only those users who require access to job configurations.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

BDU:2025-08322

CVE-2025-53656

GHSA-884F-P57J-F258

Affected Products

Jenkins

Jenkins Readyapi Functional Testing Plugin

References · 12

• https://osv.dev/vulnerability/CVE-2025-53656 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-884f-p57j-f258 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08322 · Security Note
• https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53656 · Security Note
• https://github.com/jenkinsci/soapui-pro-functional-testing-plugin · Note
• https://jenkins.io/security/advisory/2025-07-09 · Note
• https://t.me/cvenotify/128207 · Telegram Post
• http://openwall.com/lists/oss-security/2025/07/09/4 · Note
• https://twitter.com/CVEnew/status/1943335918544273498 · Twitter Post
• https://t.me/cvenotify/129483 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1943074921682178253 · Twitter Post