Skip to content
Sign in
4.3 Medium

CVE-2025-53653 Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job…

Description

Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Affected products and versions

Product Affected versions Fixed in
Jenkins Aqua Security Scanner Plugin 3.2 earliest → 3.2.8 No fix stated

Other CVEs of Jenkins Aqua Security Scanner Plugin

The 3 CVEs of Jenkins Aqua Security Scanner Plugin →
CVE-2019-10428 Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of… Not rated CVE-2019-1003069 Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins… Not rated
Track this CVE