Medium severity4.3NVD Advisory· Published May 16, 2023· Updated Jun 17, 2026

CVE-2023-2633

Description

Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to observe and capture them.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:codedxMaven	< 4.0.0	4.0.0

Affected products

Jenkins Project/Code Dx
cpe:2.3:a:jenkins:code_dx:*:*:*:*:*:jenkins:*:*
Range: <=3.1.0
ghsa-coords
pkg:maven/org.jenkins-ci.plugins/codedx
Range: < 4.0.0
Jenkins Project/Jenkins Xp Dev Plugincpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-352v-hhmh-2w8hghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-2633ghsaADVISORY
www.jenkins.io/security/advisory/2023-05-16/nvdVendor AdvisoryWEB
github.com/jenkinsci/codedx-plugin/commit/a971a75da3eaf0ab5344c2b60942e7c8809ec913ghsaWEB

News mentions

Jenkins Security Advisory 2023-05-16
Jenkins Security Advisories · May 16, 2023

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000