Jenkins Curseforge Publisher vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Jenkins Curseforge Publisher: 2 record(s), with affected versions and fixes.cpe:2.3:a:jenkins:curseforge_publisher
CVE-2025-64147
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Curseforge Publisher
Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-64146
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Curseforge Publisher
Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.