What is CVE-2023-2632?

CVE-2023-2632 is a medium-severity vulnerability in Jenkins Code Dx, classified under Plaintext Storage of a Password. CVSS score: 4.3/10. Published 2023-05-16.

How severe is CVE-2023-2632?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2023-2632 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Jenkins Code Dx

CVE-2023-2632

Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

EPSS: 0.006 (46.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Jenkins Code_dx
Jenkins Code Dx Plugin — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

jenkinsci/codedx-plugin

References

disclosure@synopsys.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-2632?: CVE-2023-2632 is a medium-severity vulnerability in Jenkins Code Dx, classified under Plaintext Storage of a Password. CVSS score: 4.3/10. Published 2023-05-16.
How severe is CVE-2023-2632?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2023-2632 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.