Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Jenkins IFTTT Build Notifier Plugin stores IFTTT keys insecurely

CVE-2025-53662 · published 1 year ago
Summary

The Jenkins IFTTT Build Notifier Plugin stores IFTTT Maker Channel Keys in plain text in job config files. This means that users with certain permissions or access to the Jenkins server can see these keys, potentially allowing them to access IFTTT services without permission. To fix this, update to a patched version of the plugin or remove jobs that use the plugin and recreate them with the updated plugin.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:ifttt-build-notifier <= 1.2
– jenkins ifttt_build_notifier <= 1.2
cpe:2.3:a:jenkins:ifttt_build_notifier:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extend...
Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-256Plaintext Storage of a Password
CWE-522Insufficiently Protected Credentials
Timeline
Published9 Jul 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-jxwj-qccf-4896 · GHSA
CVE-2025-53662 · NVD
Track software like this
Free during beta