CVE-2023-2632: API keys stored and displayed in plain text by Code Dx Plugin
First published: Tue May 16 2023(Updated: )
Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additionally, the job configuration form does not mask these API keys, increasing the potential for attackers to observe and capture them. Code Dx Plugin 4.0.0 no longer stores the API keys directly, instead accessing them through its newly added Credentials Plugin integration. Affected jobs need to be reconfigured.
Credit: disclosure@synopsys.com disclosure@synopsys.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jenkins-ci.plugins:codedx | <4.0.0 | 4.0.0 |
| Synopsys Code Dx | <=3.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-2632?
CVE-2023-2632 has been assigned a medium severity level due to the exposure of sensitive API keys.
How do I fix CVE-2023-2632?
To fix CVE-2023-2632, upgrade the Code Dx Plugin to version 4.0.0 or later.
What are the potential risks of CVE-2023-2632?
The risks of CVE-2023-2632 include unauthorized access to the Code Dx server API, leading to exposure of sensitive data.
Who is affected by CVE-2023-2632?
Users of Jenkins running Code Dx Plugin versions 3.1.0 and earlier are affected by CVE-2023-2632.
What is the nature of the vulnerability in CVE-2023-2632?
CVE-2023-2632 involves the unencrypted storage of API keys in Jenkins job configuration files, making them accessible to authorized users.
- collector/github-advisory-latest
- alias/GHSA-gpc2-f62m-c6h6
- alias/CVE-2023-2632
- agent/weakness
- agent/type
- agent/references
- agent/author
- agent/severity
- collector/github-advisory
- source/GitHub
- agent/software-canonical-lookup
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- package-manager/maven
- vendor/jenkins
- canonical/jenkins code dx
- version/jenkins code dx/3.1.0