Listen to this Post
How the CVE Works
The Jenkins VAddy Plugin (versions 1.2.8 and earlier) stores VAddy API authentication keys in plaintext within `config.xml` files on the Jenkins controller. These keys are accessible to users with Item/Extended Read permissions or anyone with filesystem access to the Jenkins controller. This exposes sensitive credentials to unauthorized extraction, potentially leading to API abuse or further system compromise.
DailyCVE Form
Platform: Jenkins
Version: ≤1.2.8
Vulnerability: Sensitive Data Exposure
Severity: Medium
Date: 2025-07-09
Prediction: Patch by 2025-08-15
What Undercode Say
grep -r "VADDY_API_KEY" /var/lib/jenkins/jobs/
<job> <authKey>plaintext_key_here</authKey> </job>
How Exploit
1. Gain Item/Extended Read access.
2. Locate `config.xml` files.
3. Extract plaintext API keys.
Protection from this CVE
- Upgrade plugin.
- Restrict file permissions.
- Use credential management.
Impact
- Unauthorized API access.
- Data leakage.
- Credential misuse.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
