Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3554 | Vendor Advisory |
Configurations
History
18 Jul 2025, 17:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Jenkins
Jenkins statistics Gatherer |
|
| CPE | cpe:2.3:a:jenkins:statistics_gatherer:*:*:*:*:*:jenkins:*:* | |
| References | () https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3554 - Vendor Advisory |
09 Jul 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-09 16:15
Updated : 2025-07-18 17:45
NVD link : CVE-2025-53654
Mitre link : CVE-2025-53654
JSON object : View
Products Affected
jenkins
- statistics_gatherer
CWE
No CWE.