Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Jenkins Warrior Framework Plugin stores passwords in plain text

CVE-2025-53675 · published 1 year ago
Summary

The Jenkins Warrior Framework Plugin stores passwords in plain text in job files on the server, allowing anyone with advanced permissions to access them. This means sensitive information like login credentials could be exposed. Update the plugin to a fixed version to protect your passwords.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:warrior <= 1.2
– jenkins warrior_framework <= 1.2
cpe:2.3:a:jenkins:warrior_framework:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission...
Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-256Plaintext Storage of a Password
Timeline
Published9 Jul 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-2g8w-9933-36vr · GHSA
CVE-2025-53675 · NVD
Track software like this
Free during beta