What is CVE-2023-30515?

CVE-2023-30515 is a high-severity vulnerability in Jenkins Thycotic Devops Secrets Vault, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.5/10. Published 2023-04-12.

How severe is CVE-2023-30515?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Jenkins Thycotic Devops Secrets Vault

CVE-2023-30515

Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

EPSS: 0.004 (32.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Jenkins Thycotic_devops_secrets_vault
Jenkins Project Thycotic Devops Secrets Vault Plugin — versions 0

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

jenkinsci-cert@googlegroups.com (vendor-advisory, Vendor Advisory)
jenkinsci-cert@googlegroups.com (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2023-30515?: CVE-2023-30515 is a high-severity vulnerability in Jenkins Thycotic Devops Secrets Vault, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.5/10. Published 2023-04-12.
How severe is CVE-2023-30515?: High severity. CVSS v3 base score is 7.5 out of 10.