Vulnerability Description
Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Wso2 Oauth | <= 1.0 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2023/04/13/3Mailing ListThird Party Advisory
- https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/04/13/3Mailing ListThird Party Advisory
- https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992Vendor Advisory
FAQ
What is CVE-2023-30527?
CVE-2023-30527 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jen...
How severe is CVE-2023-30527?
CVE-2023-30527 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-30527?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Wso2 Oauth.