CVE-2023-2632 — API keys stored and displayed in plain text by Code Dx Plugin

CVE-2023-2632

API keys stored and displayed in plain text by Code Dx Plugin PUBLISHED

Description (CNA)

Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Affected (CNA)

Vendor / product	Versions
Jenkins / Jenkins Code Dx Plugin	affected 0 through 3.1.0

CWE

CWE-256

References

https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3146

ADP enrichment

CVE

No English description supplied.

https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3146

CISA-ADP

No English description supplied.

No references supplied.