CVE-2025-53663

Vulnerability

Description

The Jenkins IBM Cloud DevOps Plugin, versions 2.0.16 and earlier, stores SonarQube authentication tokens in plaintext within job config.xml files on the Jenkins controller. This design flaw means the tokens are not encrypted or masked, making them directly readable in the stored configuration files.[1][2][3]

Exploitation

Prerequisites

An attacker must have either the Item/Extended Read permission on a Jenkins job or direct access to the Jenkins controller's file system. With Item/Extended Read, a user can view the job's configuration, including the config.xml file that contains the unencrypted token. Alternatively, any user with filesystem access to the Jenkins controller can read the files directly.[1][3]

Potential

Impact

Successful exploitation allows an attacker to retrieve SonarQube authentication tokens. These tokens could be reused to authenticate to a SonarQube server, potentially granting the attacker access to SonarQube resources or enabling further lateral movement within the CI/CD pipeline, depending on the token's permissions.[1][2]

Mitigation

Status

According to the Jenkins Security Advisory 2025-07-09, this vulnerability affects the IBM Cloud DevOps Plugin, and there is no fix available from the vendor. The plugin is also marked as deprecated. Users are advised to remove the plugin or use an alternative to prevent exposure of credentials.[1][4]