4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53660

CVE-2025-53660: Jenkins QMetry Test Management Plugin vulnerability exposes API keys

QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these API keys, increasing the potential for attackers to observe and capture them.

As of publication of this advisory, there is no fix.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53660

CVE-2025-53660:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:qmetry-test-management	maven	<= 1.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the insecure handling of the QMetry Automation API Key within the QMetry Test Management Plugin. The analysis of the 'QTMReportPublisher.java' file reveals that the plugin fails to use Jenkins' standard mechanism for managing credentials, which is the 'hudson.util.Secret' class. Instead, the API key is treated as a regular 'String'.

The root cause is in the 'QTMReportPublisher' class. Its constructor, marked with '@DataBoundConstructor', directly accepts the API key as a 'String' from the job configuration. This key is then stored in a 'String' field. The corresponding getter, 'getQtmAutomationApiKey', exposes this key as a plaintext 'String'.

This design has two security implications:

Plaintext Storage: When a Jenkins job is saved, its configuration is serialized to an XML file ('config.xml'). Because the 'qtmAutomationApiKey' field is a 'String', its value is written directly into this file without any encryption. Any user with 'Item/ExtendedRead' permission or filesystem access to the Jenkins controller can view this key.
UI Exposure: The job configuration UI does not mask the API key field. This is a direct consequence of the getter returning a 'String'. If it returned a 'Secret', Jenkins would render a password input field. This increases the risk of shoulder-surfing or other methods of capturing the key visually.

Therefore, the identified vulnerable functions are the constructor that accepts and stores the plaintext secret and the getter that exposes it for persistence and UI rendering.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.