SB2025072965 - Insufficiently protected credentials in Jenkins Testsigma Test Plan run plugin
Published: July 29, 2025
Security Bulletin ID
SB2025072965
Severity
Medium
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insufficiently protected credentials (CVE-ID: CVE-2025-53661)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due the affected application stores Testsigma API keys in job config.xml files on the Jenkins controller as part of its configuration. A remote user can observe and capture the keys and gain access to the system.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.