> CVE-2025-64146

« BACK_TO_HOME
PUBLISHED
2025-10-29 14:15
MODIFIED
2025-10-29 14:15
EPSS (Prob. Exploit)
0.17%
Top 93.6%
DATA SOURCES:
NVD 🔗 2025-10-29 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28

> DESCRIPTION

Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-23vj-j6jc-w892 MODERATE

Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files

AFFECTED PACKAGES:
MAVEN / org.jenkins-ci.plugins:curseforge-publisher
<= 1.0

> HISTORIQUE DES MODIFICATIONS

Première apparition
29/10/2025 14:15
Source: NVD
📊 ENRICHISSEMENT 19/01/2026 17:36
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3562
« BACK_TO_HOME