CVE-2025-53653: 
Java vulnerability analysis and mitigation

CVE-2025-53653 affects the Jenkins Aqua Security Scanner Plugin versions 3.2.8 and earlier. The vulnerability was discovered and reported by Aris ISSAD from Aix Marseille University, and was publicly disclosed on July 9, 2025. This security issue involves the insecure storage of Scanner Tokens for the Aqua API in Jenkins job configuration files (Jenkins Advisory, NVD).

The vulnerability is classified as CWE-311 (Missing Encryption of Sensitive Data) with a CVSS v3.1 base score of 4.3 (Medium). The technical issue stems from the plugin storing Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller. These tokens are stored as part of the plugin's configuration without proper encryption mechanisms (CISA-ADP).

The vulnerability exposes Scanner Tokens to unauthorized access, where they can be viewed by users with Item/Extended Read permission or anyone with access to the Jenkins controller file system. This exposure of sensitive credentials could potentially lead to unauthorized access to Aqua API services (Jenkins Advisory).

As of the advisory publication date, there is no fix available for this vulnerability. Users of the Aqua Security Scanner Plugin should implement additional access controls to restrict access to the Jenkins controller file system and carefully manage Item/Extended Read permissions (Jenkins Advisory).