PT-2023-20615 · Jenkins · Credentials Plugin+2

Kevin Guerroudj · Published 2023-05-16 · Updated 2023-05-25 · CVE-2023-2633

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Code Dx Plugin versions 3.1.0 and earlier

Description The issue concerns the storage and display of Code Dx server API keys. In affected versions, these keys are stored unencrypted in job config.xml files on the Jenkins controller and can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Furthermore, the job configuration form does not mask these API keys, increasing the potential for attackers to observe and capture them.

Recommendations For Jenkins Code Dx Plugin versions 3.1.0 and earlier, reconfigure affected jobs to use the Credentials Plugin integration available in version 4.0.0, which no longer stores API keys directly. As a temporary workaround, consider restricting access to the Jenkins controller file system and limiting Item/Extended Read permission to minimize the risk of API key exposure.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2023-2633

GHSA-352V-HHMH-2W8H

Affected Products

Credentials Plugin

Jenkins

Jenkins Code Dx Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-2633 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2633 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-3146 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-352v-hhmh-2w8h · Vendor Advisory
• https://github.com/jenkinsci/codedx-plugin/commit/a971a75da3eaf0ab5344c2b60942e7c8809ec913 · Note
• https://t.me/cibsecurity/64244 · Telegram Post