GitHub Advisoryadvisory · Maven

GHSA-cvg7-767r-w3fq Jenkins Kryptowire Plugin vulnerability stores unencrypted Kryptowire API key

MEDIUM Published 2025-07-09 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-53672
Ecosystem
Maven
Packages
io.jenkins.plugins:kryptowire
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-312
Reviewed
2025-07-09

Affected packages

• Maven io.jenkins.plugins:kryptowire: <= 0.2 (no fix yet)

Description

Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file `org.aerogear.kryptowire.GlobalConfigurationImpl.xml` on the Jenkins controller as part of its configuration. This API key can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2025-53672 Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References