CVE-2023-2633mediumCWE-256

CVE-2023-2633: medium-severity vulnerability in Jenkins Code Dx Plugin

API keys stored and displayed in plain text by Code Dx Plugin

Published · Updated

Follow this CVE+ Monitor Jenkins Code Dx Plugin+ Monitor org.jenkins-ci.plugins:codedx

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.4%
Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to observe and capture them.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Jenkins · Jenkins Code Dx Plugin
Related CVEs — Jenkins Code Dx Plugin

In the same product, most dangerous first.

CVE-2023-2196MEDIUMMissing permission checks in Code Dx Plugin EPSS 1.0%CVE-2023-2632MEDIUMAPI keys stored and displayed in plain text by Code Dx Plugin EPSS 0.6%CVE-2023-2195MEDIUMCSRF vulnerability and missing permission checks in Code Dx Plugin EPSS 0.4%CVE-2023-2631MEDIUMCSRF vulnerability and missing permission checks in Code Dx Plugin EPSS 0.4%