CVE-2025-53676

Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.

Score

CVSS 3.1 6.5 Medium

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2025-07-09

Last modified

2025-11-04

Weaknesses

CWE-311

Affected products

• Xooa (Jenkins)
• Jenkins Xooa Plugin (Jenkins Project)

References

• https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3522
• http://www.openwall.com/lists/oss-security/2025/07/09/4