4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67637

CVE-2025-67637: Jenkins's build authorization token is stored and displayed in plain text

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67637

CVE-2025-67637:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.main:jenkins-core	maven	>= 2.529, < 2.541	2.541
org.jenkins-ci.main:jenkins-core	maven	< 2.528.3	2.528.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-67637, concerns the storage and display of build authorization tokens in plaintext within Jenkins. The analysis of the patch reveals that the root cause lies in the serialization and UI rendering processes for these tokens.

The primary vulnerable function is hudson.model.BuildAuthorizationToken$ConverterImpl.toString. This method is part of a custom XStream converter used to serialize the BuildAuthorizationToken object. Before the patch, it simply returned the token as a raw string, which was then written directly into the job's config.xml file. This is the function responsible for the cleartext storage of the sensitive information.

Secondly, the hudson.model.BuildAuthorizationToken.getToken() method exposed the plaintext token. This method was called by the config.jelly file, which renders the job configuration user interface. The UI used a standard text field to display the value returned by getToken(), making the token visible to any user with sufficient permissions (Item/Extended Read).

The patch addresses these issues comprehensively. It changes the internal representation of the token from a String to hudson.util.Secret, a class designed for handling encrypted data.

The toString method in the converter is updated to return the encrypted value of the Secret (token.getEncryptedValue()).
The fromString method is updated to handle both encrypted and unencrypted (for migration purposes) tokens.
In the UI (config.jelly), the <f:textbox> is replaced with <f:password>, which masks the input, and it now retrieves the token via a new getEncryptedToken() method.

During exploitation, an attacker with Item/Extended Read permissions could view the job's config.xml or the configuration page in the UI. A runtime profile of a job save operation would show a call to hudson.model.BuildAuthorizationToken$ConverterImpl.toString writing the plaintext token. A profile of a user viewing the job configuration would show a call to hudson.model.BuildAuthorizationToken.getToken to render the exposed token in the UI.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.