Jenkins ByteGuard Plugin CVE-2025-64145

Exploitation requires an authenticated Jenkins user (PR:L) who can access and view the job configuration form of a job using the ByteGuard Build Actions Plugin version 1.0; the API token is rendered in cleartext on that form rather than masked. Limiting factors: the attacker must already have a valid account with permission to view the relevant job configuration, the affected product is a single third-party plugin pinned to version 1.0, and impact is confined to disclosure of a token (no integrity or availability effect). There is no unauthenticated or fully remote path, and no user-interaction trap on a victim is involved - the actor directly views the form.

This is a genuinely low-priority issue despite a MEDIUM CVSS of 4.3. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) encodes a low-impact confidentiality-only weakness: no integrity or availability effect, and PR:L confirms the attacker must already hold a valid authenticated Jenkins account with access to the job configuration form. EPSS reinforces this, at just 0.17% (6th percentile), indicating very low predicted exploitation likelihood. The CVE is NOT on the CISA KEV list and no public exploit code is referenced - exploitation status is 'no public exploit identified at time of analysis.' All signals are consistent and point in the same low-risk direction: there is no conflict between CVSS, EPSS, and KEV here. The core limitation is that this is a UI-masking (information-exposure) flaw in a single obscure plugin at version 1.0; it enables credential capture only by an actor who can already view the job config, so it is best treated as credential-hygiene remediation rather than an urgent patch priority.

A Jenkins user who already has low-privilege access to view a job's configuration opens the configuration form for a job using the ByteGuard Build Actions Plugin and reads the API token in cleartext because it is not masked. They capture the token and reuse it to impersonate the configured service or account. No public proof-of-concept is referenced, and the attack requires authenticated access (PR:L) rather than remote unauthenticated exploitation.