title: API keys stored and displayed in plain text by Code Dx Plugin
description: Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to observe and capture them.
problem types: CWE-256: Plaintext Storage of a Password
affected:
{
defaultStatus: unaffected
product: Jenkins Code Dx Plugin
vendor: Jenkins
versions:
lessThanOrEqual: 3.1.0, status: affected, version: 0, versionType: maven
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL