PT-2025-28917 · WordPress+1 · Jenkins Apica Loadtest Plugin+1

Aris Issad · Published 2025-07-09 · Updated 2025-07-18 · CVE-2025-53665

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Apica Loadtest Plugin versions 1.10 and earlier

Description: The Jenkins Apica Loadtest Plugin does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, potentially allowing attackers to observe and capture them. The plugin also stores these tokens unencrypted in config.xml files on the Jenkins controller, making them accessible to users with Item/Extended Read permission or file system access.

Recommendations: Versions prior to 1.10: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

BDU:2025-08550

CVE-2025-53665

GHSA-28J3-HPHH-CJR8

Affected Products

Jenkins

Jenkins Apica Loadtest Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2025-53665 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08550 · Security Note
• https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3540 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53665 · Security Note
• https://osv.dev/vulnerability/GHSA-28j3-hphh-cjr8 · Vendor Advisory
• https://github.com/jenkinsci/apica-loadtest-plugin · Note
• https://t.me/cvenotify/129493 · Telegram Post
• https://twitter.com/CVEnew/status/1943335909899833734 · Twitter Post
• http://openwall.com/lists/oss-security/2025/07/09/4 · Note