GitHub Advisoryadvisory · Maven

GHSA-w4xv-mj6v-p4g2 Jenkins User1st uTester Plugin vulnerability exposes unencrypted token to authenticated users

LOW Published 2025-07-09 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-53678
Ecosystem
Maven
Packages
io.jenkins.plugins:user1st-utester
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-311
Reviewed
2025-07-09

Affected packages

• Maven io.jenkins.plugins:user1st-utester: <= 1.1 (no fix yet)

Description

Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2025-53678 Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References