CVE-2023-33001 Jenkins HashiCorp Vault Plugin has improper masking of credentials

What is CVE-2023-33001?

CVE-2023-33001 is a high-severity vulnerability in Jenkins HashiCorp Vault Plugin, published on 16 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Weakness: CWE-532

Which versions are affected by CVE-2023-33001?

2 open source packages ship an affected version, including com.datapipe.jenkins.plugins:hashicorp-vault-plugin. It affects 1 product.

Products include Jenkins Hashicorp Vault.

How do I fix CVE-2023-33001?

No fix has been published for CVE-2023-33001 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-33001 being exploited?

There is no known exploitation of CVE-2023-33001 in the wild and no public exploit code.

Other vulnerabilities in Jenkins HashiCorp Vault Plugin

• CVE-2022-36888 Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests Medium 6.5
• CVE-2022-25186 Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin Medium 6.5
• CVE-2022-25197 Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin allows reading arbitrary files Medium 6.5
• CVE-2022-23109 Improper credentials masking in Jenkins HashiCorp Vault Plugin Medium 6.5
• CVE-2025-67642 Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v3fv-v9m6-26g3.