CVE-2025-53654: Jenkins Statistics Gatherer Plugin Exposes AWS Secret Key
Summary
CVE-2025-53654: Jenkins Statistics Gatherer Plugin vulnerability exposes AWS Secret Key. Affects org.jenkins.plugins.statistics.gatherer:statistics-gatherer versions < 2.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Statistics Gatherer Plugin is a tool designed to collect and analyze statistics from Jenkins instances. It integrates with AWS services to enhance functionality by allowing users to store and retrieve data securely. However, the plugin has a critical vulnerability that compromises the security of AWS credentials, specifically the AWS Secret Key, which is stored unencrypted in the configuration file.
Vulnerability Detail
Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier store the AWS Secret Key in an unencrypted format within the global configuration file 'org.jenkins.plugins.statistics.gatherer.StatisticsConfiguration.xml' on the Jenkins controller. This vulnerability arises from inadequate protection of sensitive information, allowing users with file system access to view the key. Furthermore, the global configuration form does not mask the key, increasing the risk of exposure to potential attackers. The ramifications include unauthorized access to AWS resources, leading to data breaches or service disruptions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. However, it is recommended to restrict access to the Jenkins controller file system to trusted users only, to minimize the risk of unauthorized access to the configuration files.
Conclusion
The Jenkins Statistics Gatherer Plugin has a significant vulnerability that exposes AWS Secret Keys due to improper handling of sensitive information. Users are urged to monitor for updates and restrict access to mitigate risks until a fix is available.
See every vulnerability recorded for org.jenkins.plugins.statistics.gatherer:statistics-gatherer →
FAQ
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
The vulnerability affects Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have the affected version, monitor for updates from the Jenkins community and apply any patches as soon as they are released.
Restrict access to the Jenkins controller file system to trusted users only, to minimize the risk of unauthorized access to the configuration files.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins.plugins.statistics.gatherer:statistics-gatherer.
