{"id":"CVE-2025-53654","state":"PUBLISHED","title":"Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by use","description":"Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.","publishedAt":"2025-07-09T15:39:29.010Z","updatedAt":"2025-11-04T21:11:58.078Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"jenkins","products":["Jenkins Project Jenkins Statistics Gatherer Plugin"],"affected":[{"vendor":"Jenkins Project","product":"Jenkins Statistics Gatherer Plugin","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.3","versionType":"maven"}]}],"references":["https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3554","http://www.openwall.com/lists/oss-security/2025/07/09/4"],"weaknesses":["CWE-522"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/53xxx/CVE-2025-53654.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-53654","state":"PUBLISHED","datePublished":"2025-07-09T15:39:29.010Z","dateUpdated":"2025-11-04T21:11:58.078Z","assignerShortName":"jenkins","assignerOrgId":"39769cd5-e6e2-4dc8-927e-97b3aa056f5b","dateReserved":"2025-07-08T07:51:59.762Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system."}],"affected":[{"vendor":"Jenkins Project","product":"Jenkins Statistics Gatherer Plugin","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.3","versionType":"maven"}]}],"references":[{"url":"https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3554","name":"Jenkins Security Advisory 2025-07-09","tags":["vendor-advisory"]}],"providerMetadata":{"shortName":"jenkins","orgId":"39769cd5-e6e2-4dc8-927e-97b3aa056f5b","dateUpdated":"2025-07-09T15:39:29.010Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-07-09T18:50:39.900593Z","id":"CVE-2025-53654","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-522","type":"CWE","lang":"en","description":"CWE-522 Insufficiently Protected Credentials"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-09T19:15:30.348Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/07/09/4"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T21:11:58.078Z"}}]}}}