CVE-2025-31727

EPSS 0.03%
Published 02.04.2025 15:16:00
Last modified 17.04.2025 14:38:18
Source jenkinsci-cert@googlegroups.co
Teams watchlist Login
Open Login

Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Affected products Warnungen 0 Metrics 2 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Asakusasatellite SwPlatformjenkins Version <= 0.1.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.03%	0.077

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.5	2.1	3.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CWE-549 Missing Password Field Masking

The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3523

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-31727

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-31727

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-31727

EUVD