CVE-2023-2633: API keys stored and displayed in plain text by Code Dx Plugin
Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to observe and capture them.
Other sources
Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration.
These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Additionally, the job configuration form does not mask these API keys, increasing the potential for attackers to observe and capture them.
Code Dx Plugin 4.0.0 no longer stores the API keys directly, instead accessing them through its newly added Credentials Plugin integration. Affected jobs need to be reconfigured.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2633?
CVE-2023-2633 is considered a high-severity vulnerability due to the risk of leaking sensitive API keys.
How do I fix CVE-2023-2633?
To fix CVE-2023-2633, upgrade the Jenkins Code Dx Plugin to version 4.0.0 or later.
What type of data is affected by CVE-2023-2633?
CVE-2023-2633 affects unencrypted Code Dx server API keys that are displayed in the configuration form.
What versions of Jenkins Code Dx Plugin are vulnerable to CVE-2023-2633?
Jenkins Code Dx Plugin versions 3.1.0 and earlier are vulnerable to CVE-2023-2633.
How can attackers exploit CVE-2023-2633?
Attackers can exploit CVE-2023-2633 by observing and capturing unmasked API keys displayed in the Jenkins configuration form.