CVE-2023-30515

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Jenkins Project	Jenkins Thycotic DevOps Secrets Vault Plugin	<= 1.0.0

References

http://www.openwall.com/lists/oss-security/2023/04/13/3Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3075Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/04/13/3Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3075Vendor Advisory

Timeline

Published: Apr 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-305166.5Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docke CVE-2023-305175.3Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when co CVE-2023-305184.3A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enume CVE-2023-305195.3A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corr CVE-2023-30528.8The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This CVE-2023-305205.4Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhook CVE-2023-305215.3A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger b CVE-2023-305224.3A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs CVE-2023-305234.3Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller CVE-2023-305244.3Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the po CVE-2023-305258.8A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attacker CVE-2023-305266.5A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an at