What is GHSA-cvg7-767r-w3fq?

GHSA-cvg7-767r-w3fq is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Kryptowire Plugin vulnerability stores unencrypted Kryptowire API key

Which CVE IDs does GHSA-cvg7-767r-w3fq cover?

GHSA-cvg7-767r-w3fq covers the following CVE IDs: CVE-2025-53672. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cvg7-767r-w3fq?

GHSA-cvg7-767r-w3fq has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-cvg7-767r-w3fq?

GHSA-cvg7-767r-w3fq affects 1 product, including: maven/io.jenkins.plugins:kryptowire:\u003c= 0.2.

GHSA-cvg7-767r-w3fqMediumCVSS 6.5

Jenkins Kryptowire Plugin vulnerability stores unencrypted Kryptowire API key

Vendor

GitHub Security Advisories

Published

July 9, 2025

Last Modified

November 5, 2025

🔗 CVE IDs covered (1)

CVE-2025-53672 →

📋 Description

Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file org.aerogear.kryptowire.GlobalConfigurationImpl.xml on the Jenkins controller as part of its configuration.

This API key can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

🎯 Affected products1

maven/io.jenkins.plugins:kryptowire:<= 0.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-53672
https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3525
http://www.openwall.com/lists/oss-security/2025/07/09/4
https://github.com/advisories/GHSA-cvg7-767r-w3fq