PT-2025-28930 · Jenkins · Jenkins User1St Utester Plugin+1

Said Abdesslem Messadi · Published 2025-07-09 · Updated 2025-07-10 · CVE-2025-53678

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins User1st uTester Plugin versions 1.1 and earlier

Description: The Jenkins User1st uTester Plugin stores the uTester JWT (JSON Web Token) token unencrypted in its global configuration file on the Jenkins controller. This allows users with access to the Jenkins controller file system to view the token.

Recommendations: Update Jenkins User1st uTester Plugin to a version later than 1.1.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

BDU:2025-08585

CVE-2025-53678

GHSA-W4XV-MJ6V-P4G2

Affected Products

Jenkins

Jenkins User1St Utester Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2025-53678 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w4xv-mj6v-p4g2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08585 · Security Note
• https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53678 · Security Note
• https://github.com/jenkinsci/user1st-utester-plugin · Note
• https://twitter.com/CVEnew/status/1943335898105410038 · Twitter Post
• http://openwall.com/lists/oss-security/2025/07/09/4 · Note