CVE-2023-30515
HIGHCVSS 7.5/10EPSS 0.40%
Last modified
CVE-2023-30515 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Thycotic Devops Secrets Vault | <= 1.0.0 |
References
- http://www.openwall.com/lists/oss-security/2023/04/13/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/04/13/3Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-30515?
Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
How severe is CVE-2023-30515?
CVE-2023-30515 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.40% probability of exploitation in the next 30 days.
How do I fix CVE-2023-30515?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-30509Multiple authenticated path traversal vulnerabilities exist …6.5
- CVE-2023-3051The Page Builder by AZEXO plugin for WordPress is vulnerable…5.4
- CVE-2023-30510A vulnerability exists in the Aruba EdgeConnect Enterprise w…4.3
- CVE-2023-30512CubeFS through 3.2.1 allows Kubernetes cluster-level privile…6.5
- CVE-2023-30513Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier doe…7.5
- CVE-2023-30514Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earli…7.5
- CVE-2023-30516Jenkins Image Tag Parameter Plugin 2.0 improperly introduces…6.5
- CVE-2023-30517Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earl…5.3
- CVE-2023-30518A missing permission check in Jenkins Thycotic Secret Server…4.3
- CVE-2023-30519A missing permission check in Jenkins Quay.io trigger Plugin…5.3
- CVE-2023-3052The Page Builder by AZEXO plugin for WordPress is vulnerable…8.8
- CVE-2023-30520Jenkins Quay.io trigger Plugin 0.1 and earlier does not limi…5.4
Are you affected by CVE-2023-30515?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST