CVE-2025-64147

MediumCVSS 4.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Risk Assessment

API keys visible on the job configuration form may be captured by anyone with access to the Jenkins interface. This can lead to unauthorized access to resources protected by those keys.

Recommendation

Update the Jenkins Curseforge Publisher Plugin to a patched version. In the meantime, restrict access to job configuration and consider rotating exposed API keys.

Other vulnerabilities in Jenkins Curseforge Publisher Plugin

CVE-2025-64146Medium
Jenkins Curseforge Publisher Plugin 1.0 stores API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the controller file system.

Original NVD description (English source)

Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS