VDB
CVE-2025-31728
CVE-2025-31728
PUBLISHED
CVSS 4.300000190734863 MEDIUM
Jenkins AsakusaSatellite Plugin Does not Mask API Keys via Job Configuration Form
Reported by jenkins · Published April 2, 2025
asakusa-satellite-plugin is fixed in 0.1.1 (Maven Central)
Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin | Maven Central | 0.1.1 |
| asakusasatellite | jenkins | 0.1.1 |
| Jenkins AsakusaSatellite Plugin | Jenkins Project | 0.1.1 |
Risk scores
CVSS 3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins Project | Jenkins AsakusaSatellite Plugin | 0 |
| Jenkins Project | Jenkins AsakusaSatellite Plugin | 0 |
| Maven | org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin | 0 |
Timeline
- Apr 2, 2025 CVE Published
- Apr 2, 2025 Coalition ESS Score (11 in total, the first dated here)
- Apr 2, 2025 PoC Published
- Apr 3, 2025 EPSS Score (30 in total, the first dated here)
- Apr 3, 2025 CVE Updated
- Mar 17, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-31728
vulnetix vdb fixes CVE-2025-31728Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-31728/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart