GitStock

jenkinsci/ibm-cloud-devops-plugin · Security

Jenkins IBM Cloud DevOps Plugin vulnerability exposes SonarQube authentication tokens

Open GitHub
GHSA ID
GHSA-pgrx-5f8q-r5mq
CVE ID
CVE-2025-53663
Severity
medium
Published
Updated
CVSS
4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v3
4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

CWEs

  • CWE-311 · Missing Encryption of Sensitive Data
  • CWE-522 · Insufficiently Protected Credentials

References