CVE-2023-24454

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-244554.3Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers CVE-2023-244569.8Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.CVE-2023-244576.5A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick user CVE-2023-244588.8A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-s CVE-2023-244596.5A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an atta CVE-2023-24466.5The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and includ CVE-2023-244607.8Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially CVE-2023-244615.9An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to imperso CVE-2023-244634.3Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to po CVE-2023-244645.4Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the pro CVE-2023-244655.5Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and prior versions, OpenHarmony-v3.0.7 and prior versions has a null pointer refere CVE-2023-244669.8Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200.