CVE-2025-53657: Jenkins ReadyAPI Functional Testing Plugin vulnerability exposes secrets

The vulnerability lies in the way the Jenkins ReadyAPI Functional Testing Plugin stores credentials. The analysis of the source code, specifically the JenkinsSoapUIProTestRunner.java file, reveals that the plugin uses @DataBoundSetter annotated methods to populate fields from the Jenkins job configuration. The methods setSlmLicenceAccessKey, setPassword, and setSlmLicenseClientSecret all accept String arguments and store them directly as member variables. Jenkins then persists these values in the config.xml file for the job. Because the fields are simple String types and not the Jenkins-provided hudson.util.Secret type, the values are stored in plaintext. This allows anyone with read access to the job configuration or the Jenkins controller's filesystem to view these sensitive credentials. The perform method later retrieves these plaintext credentials to use them in the build process, confirming their use in an insecure manner.