What is CVE-2023-2633?

CVE-2023-2633 is a medium-severity vulnerability in Jenkins Code Dx, classified under Plaintext Storage of a Password. CVSS score: 4.3/10. Published 2023-05-16.

How severe is CVE-2023-2633?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2023-2633 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Jenkins Code Dx

CVE-2023-2633

Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to observe and capture them.

EPSS: 0.004 (33.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Jenkins Code_dx
Jenkins Code Dx Plugin — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

jenkinsci/codedx-plugin

References

disclosure@synopsys.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-2633?: CVE-2023-2633 is a medium-severity vulnerability in Jenkins Code Dx, classified under Plaintext Storage of a Password. CVSS score: 4.3/10. Published 2023-05-16.
How severe is CVE-2023-2633?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2023-2633 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.