CVE-2025-64145: Medium severity Jenkins ByteGuard Build Actions Plugin vulnerability
Jenkins ByteGuard Build Actions Plugin 1.0 and earlier stores API tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.
These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Additionally, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them.
As of publication of this advisory, there is no fix.
Other sources
Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64145?
CVE-2025-64145 is considered a high severity vulnerability due to the risk of API tokens being exposed.
How do I fix CVE-2025-64145?
To mitigate CVE-2025-64145, update the Jenkins ByteGuard Build Actions Plugin to the latest version that addresses this security issue.
What type of information is exposed in CVE-2025-64145?
CVE-2025-64145 exposes API tokens displayed on the job configuration form, which can be captured by attackers.
Is CVE-2025-64145 specific to certain versions of the Jenkins ByteGuard Build Actions Plugin?
Yes, CVE-2025-64145 specifically affects version 1.0 of the Jenkins ByteGuard Build Actions Plugin.
How can I determine if I am affected by CVE-2025-64145?
If you are using version 1.0 of the Jenkins ByteGuard Build Actions Plugin, you are affected by CVE-2025-64145.