CVE-2025-53655: Jenkins Statistics Gatherer Plugin does not mask AWS Secret Key

The vulnerability lies in the improper handling of the AWS Secret Key within the Jenkins Statistics Gatherer Plugin. The root cause is that the awsSecretKey field in the StatisticsConfiguration class is of type String instead of the Jenkins-provided hudson.util.Secret class, which is designed to handle sensitive data.

The analysis of the StatisticsConfiguration.java file reveals that the setAwsSecretKey method directly accepts a plaintext String and persists it to the configuration file via the save() method. The getAwsSecretKey method exposes this plaintext secret. Furthermore, the configure method processes the web UI form submission, binding the plaintext secret from the HTTP request to the configuration object. This leads to the secret key being stored unencrypted on the Jenkins controller's filesystem in org.jenkins.plugins.statistics.gatherer.StatisticsConfiguration.xml and being displayed in plaintext in the web UI, making it accessible to anyone with filesystem access or the ability to view the Jenkins global configuration page.