~ / search / GHSA-3wgg-3j4j-3f69

GHSA-3wgg-3j4j-3f69

Jenkins Aqua Security Scanner Plugin vulnerability exposes scanner tokens

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-53653

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:aqua-security-scanner <= 3.2.8 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, there is no fix.

References

External links from the advisory. They lead to third-party sites.