CVE-2023-30523

Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

• CWE-312
• CWE-311

• http://www.openwall.com/lists/oss-security/2023/04/13/3Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2945Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/04/13/3Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2945Vendor Advisory

Published

Apr 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30518A missing permission check in Jenkins Thycotic Secret Server…4.3
• CVE-2023-30519A missing permission check in Jenkins Quay.io trigger Plugin…5.3
• CVE-2023-3052The Page Builder by AZEXO plugin for WordPress is vulnerable…8.8
• CVE-2023-30520Jenkins Quay.io trigger Plugin 0.1 and earlier does not limi…5.4
• CVE-2023-30521A missing permission check in Jenkins Assembla merge request…5.3
• CVE-2023-30522A missing permission check in Jenkins Fogbugz Plugin 2.2.17 …4.3
• CVE-2023-30524Jenkins Report Portal Plugin 0.5 and earlier does not mask R…4.3
• CVE-2023-30525A cross-site request forgery (CSRF) vulnerability in Jenkins…8.8
• CVE-2023-30526A missing permission check in Jenkins Report Portal Plugin 0…6.5
• CVE-2023-30527Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oa…4.3
• CVE-2023-30528Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the …6.5
• CVE-2023-30529Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier…4.3