CVE-2023-30527

MEDIUM

Jenkins WSO2 Oauth Plugin < 1.0 - Cleartext Storage of Sensitive Information in Global Config

Title source: llm
STIX 2.1

Description

Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

References (2)

Core 2
Core References
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/13/3

Scores

CVSS v3 4.3
EPSS 0.0019
EPSS Percentile 40.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-312
Status published
Products (2)
jenkins/wso2_oauth < 1.0
org.jenkins-ci.plugins/wso2id-oauth 0Maven
Published Apr 12, 2023
Tracked Since Feb 18, 2026