PT-2023-20611 · Jenkins · Credentials Plugin+2

Kevin Guerroudj · Published 2023-05-16 · Updated 2023-05-25 · CVE-2023-2632

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Code Dx Plugin versions 3.1.0 and earlier

Description The issue concerns the storage of Code Dx server API keys in an unencrypted manner in job config.xml files on the Jenkins controller. These keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Furthermore, the job configuration form does not mask these API keys, increasing the potential for them to be observed and captured by attackers.

Recommendations For Jenkins Code Dx Plugin versions 3.1.0 and earlier, reconfigure affected jobs to use the Credentials Plugin integration, as provided in version 4.0.0, which no longer stores API keys directly. As a temporary workaround, consider restricting access to the Jenkins controller file system and limiting Item/Extended Read permission to minimize the risk of API key exposure.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2023-2632

GHSA-GPC2-F62M-C6H6

Affected Products

Credentials Plugin

Jenkins

Jenkins Code Dx Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2023-2632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2632 · Security Note
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-3146 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gpc2-f62m-c6h6 · Vendor Advisory
• https://github.com/jenkinsci/codedx-plugin/commit/a971a75da3eaf0ab5344c2b60942e7c8809ec913 · Note
• https://t.me/cibsecurity/64260 · Telegram Post