Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2025-53677

Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it.

VectorNETWORK

PublishedJul 09, 2025, 16:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

io.jenkins.plugins:xooa(Maven)0N/AN/A

References

https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3522
http://www.openwall.com/lists/oss-security/2025/07/09/4

Weakness Type

CWE-256

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK