PT-2025-28928 · Jenkins · Jenkins Xooa Plugin+1

Romuald Moisan · Published 2025-07-09 · Updated 2025-07-10 · CVE-2025-53676

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Xooa Plugin versions 0.0.7 and earlier

Description: The Jenkins Xooa Plugin stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller. This allows users with access to the Jenkins controller file system to view the token.

Recommendations: Update to a newer version of the Jenkins Xooa Plugin.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

BDU:2025-08571

CVE-2025-53676

GHSA-56H7-R62C-83QP

Affected Products

Jenkins

Jenkins Xooa Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-56h7-r62c-83qp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53676 · Security Note
• https://bdu.fstec.ru/vul/2025-08571 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53676 · Vendor Advisory
• https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3522 · Vendor Advisory
• https://github.com/jenkinsci/xooa-plugin · Note
• https://twitter.com/VulmonFeeds/status/1943041645961715792 · Twitter Post
• https://twitter.com/CVEnew/status/1943335899942584338 · Twitter Post
• http://openwall.com/lists/oss-security/2025/07/09/4 · Note