CVE-2025-53677

The Jenkins Xooa Plugin up to version 0.0.7 does not mask the Xooa Deployment Token when displayed on the global configuration form [1][3]. This means the token is shown in plaintext instead of being obfuscated with asterisks, contrary to typical credential handling best practices.

To exploit this issue, an attacker needs only the ability to view the global configuration page within Jenkins. No special authentication beyond standard Jenkins access is required, as the token is visible to any user who can navigate to that page [1]. This increases the risk of credential capture by malicious insiders or external attackers who have gained low-level access.

The Xooa Deployment Token provides access to the Xooa blockchain platform. If captured, an attacker could use it to perform unauthorized actions on the Xooa infrastructure, potentially compromising the integrity or confidentiality of blockchain operations [1][3].

As of the advisory date, no fixed version of the Xooa Plugin has been released. Users are advised to restrict access to the global configuration form or remove the plugin if it is not essential [1].