Unencrypted Key Exposure in Jenkins IFTTT Build Notifier Plugin
CVE-2025-53662

6.5MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Ifttt Build Notifier Plugin
Vendor
CVE Published:
9 July 2025

What is CVE-2025-53662?

The IFTTT Build Notifier Plugin for Jenkins has a significant security flaw where Maker Channel Keys are stored in plaintext within job configuration files (config.xml) on the Jenkins controller. This exposure allows any user with Item/Extended Read permissions or those with access to the file system of the Jenkins controller to view sensitive information, thereby increasing the risk of unauthorized access and exploitation.

Affected Version(s)

Jenkins IFTTT Build Notifier Plugin 0 <= 1.2

References

https://www.jenkins.io/security/advisory/2025-07-09/#SECU...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53662 : Unencrypted Key Exposure in Jenkins IFTTT Build Notifier Plugin