{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.1.1"}],"component":"org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin","cve_ids":["CVE-2025-31727"],"ecosystem":"Maven","epss":0.00288,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fv9q-fq62-c6qg","id":"tcs_01M5N8WR21DHMYN4GTJTGRJ399","modified_at":"2025-04-02T23:12:09.567893Z","published_at":"2025-04-02T15:31:38Z","references":["https://osv.dev/vulnerability/GHSA-fv9q-fq62-c6qg","https://nvd.nist.gov/vuln/detail/CVE-2025-31727","https://github.com/jenkinsci/asakusa-satellite-plugin","https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3523"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-fv9q-fq62-c6qg","url":"https://osv.dev/vulnerability/GHSA-fv9q-fq62-c6qg"}],"summary":"Jenkins AsakusaSatellite Plugin Stores API Keys Unencrypted in Job `config.xml` Files"}