PT-2025-54708 · Maven · Org.Jenkins-Ci.Main:Jenkins-Core

Published 2025-12-10 · Updated 2025-12-10

OSV

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

GHSA-HXJG-2JVF-H3RX

Affected Products

Org.Jenkins-Ci.Main:Jenkins-Core

References · 5

• https://osv.dev/vulnerability/GHSA-hxjg-2jvf-h3rx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67638 · Security Note
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/4710d65339251aaf1d1599f19545db99be24d981 · Note
• https://jenkins.io/security/advisory/2025-12-10/#SECURITY-783 · Note