CVE-2025-53655: Jenkins Statistics Gatherer Plugin Exposes AWS Secret Key in Configuration
Summary
CVE-2025-53655: Jenkins Statistics Gatherer Plugin does not mask AWS Secret Key. Affects org.jenkins.plugins.statistics.gatherer:statistics-gatherer versions < 2.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Statistics Gatherer Plugin is designed to collect and report usage statistics for Jenkins installations. It allows administrators to monitor usage patterns and improve the performance of Jenkins. However, this plugin has a critical vulnerability that exposes sensitive information, specifically the AWS Secret Key, in an unencrypted format within its configuration files.
Vulnerability Detail
Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier store the AWS Secret Key unencrypted in the global configuration file 'org.jenkins.plugins.statistics.gatherer.StatisticsConfiguration.xml' on the Jenkins controller. This key can be accessed by any user with file system access to the Jenkins controller, posing a significant security risk. Additionally, the configuration form does not mask the AWS Secret Key, further increasing the likelihood of unauthorized access and potential exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk, consider restricting access to the Jenkins controller file system and ensuring that only trusted users have access to the Jenkins environment. Regularly audit user permissions and monitor for any unauthorized access attempts.
Conclusion
The Jenkins Statistics Gatherer Plugin has a vulnerability that exposes the AWS Secret Key in an unencrypted format, posing a risk to users with access to the Jenkins controller. While there is currently no fix available, users should take precautions to secure their environments and monitor for updates.
See every vulnerability recorded for org.jenkins.plugins.statistics.gatherer:statistics-gatherer →
FAQ
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
No, the vulnerability requires access to the Jenkins controller file system, making it less likely to be exploited remotely.
If you suspect that your AWS Secret Key has been compromised, immediately rotate the key in your AWS account and update your Jenkins configuration accordingly.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
As of now, there is no fix available. It is advisable to keep an eye on the plugin's repository for any updates or patches.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins.plugins.statistics.gatherer:statistics-gatherer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
