Sensitive Data Exposure in Jenkins QMetry Test Management Plugin by Jenkins
CVE-2025-53660

4.3MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Qmetry Test Management Plugin
Vendor
CVE Published:
9 July 2025

What is CVE-2025-53660?

The Jenkins QMetry Test Management Plugin up to version 1.13 contains a flaw that results in the exposure of sensitive Qmetry Automation API Keys. These keys are not masked in the job configuration form, allowing potential attackers to easily observe and capture the keys used in various job configurations, thereby compromising connected services and systems.

Affected Version(s)

Jenkins QMetry Test Management Plugin 0 <= 1.13

References

https://www.jenkins.io/security/advisory/2025-07-09/#SECU...
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53660 : Sensitive Data Exposure in Jenkins QMetry Test Management Plugin by Jenkins