PT-2025-28925 · Jenkins · Jenkins Sensedia Api Platform Tools Plugin+1

Romuald Moisan + 1 · Published 2025-07-09 · Updated 2025-10-01 · CVE-2025-53673

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Sensedia Api Platform Tools Plugin version 1.0

Description: The Jenkins Sensedia Api Platform Tools Plugin stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller. This allows users with access to the Jenkins controller file system to view the token.

Recommendations: Ensure the Jenkins controller file system is adequately secured to prevent unauthorized access.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

BDU:2025-08554

CVE-2025-53673

GHSA-93J6-JCJW-3RWP

Affected Products

Jenkins

Jenkins Sensedia Api Platform Tools Plugin

References · 10

• https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3551 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-93j6-jcjw-3rwp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53673 · Security Note
• https://bdu.fstec.ru/vul/2025-08554 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53673 · Vendor Advisory
• https://github.com/jenkinsci/sensedia-api-platform-plugin · Note
• https://t.me/cveNotify/137108 · Telegram Post
• http://openwall.com/lists/oss-security/2025/07/09/4 · Note
• https://twitter.com/CVEnew/status/1943335902605910423 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1943051884970774588 · Twitter Post