Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
References
| Link | Resource |
|---|---|
| https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3525 | Vendor Advisory |
Configurations
History
01 Oct 2025, 20:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Jenkins kryptowire
Jenkins |
|
| References | () https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3525 - Vendor Advisory | |
| CPE | cpe:2.3:a:jenkins:kryptowire:*:*:*:*:*:jenkins:*:* |
10 Jul 2025, 13:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-09 16:15
Updated : 2025-10-01 20:28
NVD link : CVE-2025-53672
Mitre link : CVE-2025-53672
CVE.ORG link : CVE-2025-53672
JSON object : View
Products Affected
jenkins
- kryptowire
CWE
CWE-312
Cleartext Storage of Sensitive Information