GitHub Advisoryadvisory · Maven

GHSA-pgrx-5f8q-r5mq Jenkins IBM Cloud DevOps Plugin vulnerability exposes SonarQube authentication tokens

MEDIUM Published 2025-07-09 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-53663
Ecosystem
Maven
Packages
com.ibm.devops:ibm-cloud-devops
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-311, CWE-522
Reviewed
2025-07-09

Affected packages

• Maven com.ibm.devops:ibm-cloud-devops: <= 2.0.16 (no fix yet)

Description

Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration. These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2025-53663 Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the… vulnerability

Weakness · CWE (2)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References