CVE-2025-53676

Vulnerability

Description

The Jenkins Xooa Plugin, up to version 0.0.7, stores the Xooa Deployment Token in plaintext within its global configuration file on the Jenkins controller. This token is not encrypted or masked, allowing any user with read access to the Jenkins controller's file system to retrieve it [1][3].

Attack

Vector

An attacker who gains access to the Jenkins controller's file system—whether through a compromised Jenkins user account, a separate vulnerability, or direct system access—can read the Xooa Deployment Token from the global configuration file. No special permissions within Jenkins are required beyond filesystem read access [1][2].

Impact

With the Xooa Deployment Token, an attacker can authenticate to Xooa blockchain services, potentially gaining unauthorized access to deploy or manage blockchain applications. This could lead to data exposure, service disruption, or further compromise of the Xooa environment [1][2].

Mitigation

Status

As of the Jenkins Security Advisory 2025-07-09, the vulnerability remains unresolved, with no patched version of the Xooa Plugin available. Users are advised to restrict filesystem access to the Jenkins controller and consider removing or disabling the plugin if not essential [1][2].