Description
Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
Scores
CVSS v3
6.5
EPSS
0.0004
EPSS Percentile
10.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-311
Status
published
Products (2)
io.jenkins.plugins/xooa
0Maven
jenkins/xooa
< 0.0.7
Published
Jul 09, 2025
Tracked Since
Feb 18, 2026