CVE-2023-2632: API keys stored and displayed in plain text by Code Dx Plugin
Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration.
These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Additionally, the job configuration form does not mask these API keys, increasing the potential for attackers to observe and capture them.
Code Dx Plugin 4.0.0 no longer stores the API keys directly, instead accessing them through its newly added Credentials Plugin integration. Affected jobs need to be reconfigured.
Other sources
Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2632?
CVE-2023-2632 has been assigned a medium severity level due to the exposure of sensitive API keys.
How do I fix CVE-2023-2632?
To fix CVE-2023-2632, upgrade the Code Dx Plugin to version 4.0.0 or later.
What are the potential risks of CVE-2023-2632?
The risks of CVE-2023-2632 include unauthorized access to the Code Dx server API, leading to exposure of sensitive data.
Who is affected by CVE-2023-2632?
Users of Jenkins running Code Dx Plugin versions 3.1.0 and earlier are affected by CVE-2023-2632.
What is the nature of the vulnerability in CVE-2023-2632?
CVE-2023-2632 involves the unencrypted storage of API keys in Jenkins job configuration files, making them accessible to authorized users.