Medium severity · published Jul 9, 2025
CVE-2025-53655
Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and…
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jenkins Statistics Gatherer Plugin · Jenkins Project
through 2.0.3 · source: vendor
SG
Statistics Gatherer · Jenkins
through 2.0.3 · source: NVD
Affected product
JS
Jenkins Statistics Gatherer Plugin
Jenkins Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53655
Vendor Advisory
https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3554
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/07/09/4
More from Jenkins Statistics Gatherer Plugin
6.5
CVE-2025-53654
Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by…