GitHub Advisoryadvisory · Maven

GHSA-8wp4-r84g-gcmw Jenkins Testsigma Test Plan vulnerability exposes API keys via job configuration form

LOW Published 2025-07-09 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-53661
Ecosystem
Maven
Packages
io.jenkins.plugins:testsigma
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-522
Reviewed
2025-07-09

Affected packages

• Maven io.jenkins.plugins:testsigma: <= 1.6 (no fix yet)

Description

Jenkins Testsigma Test Plan run Plugin stores Testsigma API keys in job `config.xml` files on the Jenkins controller as part of its configuration. While these API keys are stored encrypted on disk, in Testsigma Test Plan run Plugin 1.6 and earlier, the job configuration form does not mask these API keys, increasing the potential for attackers to observe and capture them. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2025-53661 Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References