Moderate severityNVD Advisory· Published May 16, 2023· Updated Jan 22, 2025

API keys stored and displayed in plain text by Code Dx Plugin

CVE-2023-2632

Description

Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:codedxMaven	< 4.0.0	4.0.0

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/codedx
Range: < 4.0.0
Jenkins Project/Jenkins Xp Dev Plugincpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-gpc2-f62m-c6h6ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-2632ghsaADVISORY
github.com/jenkinsci/codedx-plugin/commit/a971a75da3eaf0ab5344c2b60942e7c8809ec913ghsaWEB
www.jenkins.io/security/advisory/2023-05-16/ghsaWEB

News mentions

Jenkins Security Advisory 2023-05-16
Jenkins Security Advisories · May 16, 2023

cvss	0.260
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000