CVE-2023-30527

Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

• CWE-312
• CWE-312

• http://www.openwall.com/lists/oss-security/2023/04/13/3Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/04/13/3Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992Vendor Advisory

Published

Apr 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30521A missing permission check in Jenkins Assembla merge request…5.3
• CVE-2023-30522A missing permission check in Jenkins Fogbugz Plugin 2.2.17 …4.3
• CVE-2023-30523Jenkins Report Portal Plugin 0.5 and earlier stores ReportPo…4.3
• CVE-2023-30524Jenkins Report Portal Plugin 0.5 and earlier does not mask R…4.3
• CVE-2023-30525A cross-site request forgery (CSRF) vulnerability in Jenkins…8.8
• CVE-2023-30526A missing permission check in Jenkins Report Portal Plugin 0…6.5
• CVE-2023-30528Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the …6.5
• CVE-2023-30529Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier…4.3
• CVE-2023-3053The Page Builder by AZEXO plugin for WordPress is vulnerable…4.3
• CVE-2023-30530Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores t…4.3
• CVE-2023-30531Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not…6.5
• CVE-2023-30532A missing permission check in Jenkins TurboScript Plugin 1.3…6.5