CVE-2025-64146

MediumCVSS 4.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Jenkins Curseforge Publisher Plugin 1.0 stores API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the controller file system.

Risk Assessment

Exposure of API keys may allow attackers unauthorized access to external services, potentially leading to data security breaches.

Recommendation

Update the plugin to a version that encrypts API keys and restrict access to config.xml files.

Other vulnerabilities in Jenkins Curseforge Publisher Plugin

CVE-2025-64147Medium
Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Original NVD description (English source)

Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS