CVE-2025-53673: Jenkins Sensedia API Platform Plugin Exposes Unencrypted Tokens
Summary
CVE-2025-53673: Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file com.sensedia.configuration.SensediaApiConfiguration.xml on the Jenkins control... Affects org.jenkins-ci.plugins:sensedia-api-platform versions < 1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Sensedia API Platform Plugin is designed to facilitate integration with the Sensedia API Manager, allowing users to manage API configurations directly from the Jenkins environment. This plugin enhances the functionality of Jenkins by enabling seamless API management, but it has a critical vulnerability that exposes sensitive information.
Vulnerability Detail
The Jenkins Sensedia API Platform Plugin version 1.0 contains a vulnerability where the Sensedia API Manager integration token is stored unencrypted in the global configuration file located at 'com.sensedia.configuration.SensediaApiConfiguration.xml' on the Jenkins controller. This configuration file can be accessed by users with file system access to the Jenkins controller, potentially leading to unauthorized access to the API Manager. Furthermore, the global configuration form does not mask the token, increasing the risk of exposure to attackers who may observe the token during configuration.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users are encouraged to restrict access to the Jenkins controller file system to minimize the risk of unauthorized access to the configuration file.
Conclusion
The Jenkins Sensedia API Platform Plugin vulnerability (CVE-2025-53673) poses a significant risk by exposing unencrypted tokens in its configuration file. Users are advised to monitor for updates and restrict access to the Jenkins controller to protect sensitive information.
See every vulnerability recorded for org.jenkins-ci.plugins:sensedia-api-platform →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
The main risk is that unauthorized users may gain access to the unencrypted Sensedia API Manager integration token, leading to potential misuse of the API.
As of now, there is no patch available. Users should keep an eye on updates from the Jenkins plugin repository.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have access to the Jenkins controller, ensure that access is restricted to trusted users only to mitigate the risk of token exposure.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:sensedia-api-platform.
