CVE-2023-30528

EPSS 0.03%
Published 12.04.2023 18:15:11
Last modified 07.02.2025 19:15:23
Source jenkinsci-cert@googlegroups.co
Teams watchlist Login
Open Login

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Wso2 Oauth SwPlatformjenkins Version <= 1.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.03%	0.064

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

http://www.openwall.com/lists/oss-security/2023/04/13/3

Third Party Advisory

Mailing List

https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-30528

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-30528

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-30528

EUVD