jenkinsci/xooa-plugin · Security
Jenkins Xooa Plugin vulnerability does not mask its Xooa Deployment Token
- GHSA ID
- GHSA-23j7-px3w-jwp2
- CVE ID
- CVE-2025-53677
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it.
CWEs
- CWE-256 · Plaintext Storage of a Password