{"id":"CVE-2025-53657","state":"PUBLISHED","title":"Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configuration form, increasing","description":"Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configuration form, increasing the potential for attackers to observe and capture them.","publishedAt":"2025-07-09T15:39:30.813Z","updatedAt":"2025-11-04T21:12:04.123Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"CISA-ADP"},"assigner":"jenkins","products":["Jenkins Project Jenkins ReadyAPI Functional Testing Plugin"],"affected":[{"vendor":"Jenkins Project","product":"Jenkins ReadyAPI Functional Testing Plugin","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.11","versionType":"maven"}]}],"references":["https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3556","http://www.openwall.com/lists/oss-security/2025/07/09/4"],"weaknesses":["CWE-522"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/53xxx/CVE-2025-53657.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-53657","state":"PUBLISHED","datePublished":"2025-07-09T15:39:30.813Z","dateUpdated":"2025-11-04T21:12:04.123Z","assignerShortName":"jenkins","assignerOrgId":"39769cd5-e6e2-4dc8-927e-97b3aa056f5b","dateReserved":"2025-07-08T07:51:59.762Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configuration form, increasing the potential for attackers to observe and capture them."}],"affected":[{"vendor":"Jenkins Project","product":"Jenkins ReadyAPI Functional Testing Plugin","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.11","versionType":"maven"}]}],"references":[{"url":"https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3556","name":"Jenkins Security Advisory 2025-07-09","tags":["vendor-advisory"]}],"providerMetadata":{"shortName":"jenkins","orgId":"39769cd5-e6e2-4dc8-927e-97b3aa056f5b","dateUpdated":"2025-07-09T15:39:30.813Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-07-09T18:50:12.031409Z","id":"CVE-2025-53657","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-522","type":"CWE","lang":"en","description":"CWE-522 Insufficiently Protected Credentials"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-09T19:15:11.504Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/07/09/4"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T21:12:04.123Z"}}]}}}