{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.1.1"}],"component":"org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin","cve_ids":["CVE-2025-31728"],"ecosystem":"Maven","epss":0.00288,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-m254-f6h4-p93g","id":"tcs_01M5N94153DM3FWFZA3JCWVY9W","modified_at":"2025-04-02T23:12:09.635102Z","published_at":"2025-04-02T15:31:38Z","references":["https://osv.dev/vulnerability/GHSA-m254-f6h4-p93g","https://nvd.nist.gov/vuln/detail/CVE-2025-31728","https://github.com/jenkinsci/asakusa-satellite-plugin","https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3523"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-m254-f6h4-p93g","url":"https://osv.dev/vulnerability/GHSA-m254-f6h4-p93g"}],"summary":"Jenkins AsakusaSatellite Plugin Does not Mask API Keys via Job Configuration Form"}