Moderate severityNVD Advisory· Published May 16, 2023· Updated Jan 22, 2025

API keys stored and displayed in plain text by Code Dx Plugin

CVE-2023-2633

Description

Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to observe and capture them.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:codedxMaven	< 4.0.0	4.0.0

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/codedx
Range: < 4.0.0
Jenkins Project/Jenkins Xp Dev Plugincpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-352v-hhmh-2w8hghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-2633ghsaADVISORY
github.com/jenkinsci/codedx-plugin/commit/a971a75da3eaf0ab5344c2b60942e7c8809ec913ghsaWEB
www.jenkins.io/security/advisory/2023-05-16/ghsaWEB

News mentions

Jenkins Security Advisory 2023-05-16
Jenkins Security Advisories · May 16, 2023

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000