CVE-2024-39459

In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2024/06/26/2	Mailing List
https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495	Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/06/26/2	Mailing List
https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:plain_credentials:*:*:*:*:*:jenkins:*:*

History

10 Oct 2025, 15:26

Type	Values Removed	Values Added
CPE		cpe:2.3:a:jenkins:plain_credentials::::::jenkins::*
First Time		Jenkins plain Credentials Jenkins
References	~~() http://www.openwall.com/lists/oss-security/2024/06/26/2 -~~	() http://www.openwall.com/lists/oss-security/2024/06/26/2 - Mailing List
References	~~() https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495 -~~	() https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495 - Vendor Advisory

Information

Published : 2024-06-26 17:15

Updated : 2025-10-10 15:26

NVD link : CVE-2024-39459

Mitre link : CVE-2024-39459

CVE.ORG link : CVE-2024-39459

JSON object : View

Products Affected

jenkins

plain_credentials

CWE

CWE-922

Insecure Storage of Sensitive Information

{"id": "CVE-2024-39459", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-06-26T17:15:27.110", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/06/26/2", "tags": ["Mailing List"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495", "tags": ["Vendor Advisory"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "http://www.openwall.com/lists/oss-security/2024/06/26/2", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-922"}]}], "descriptions": [{"lang": "en", "value": "In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials)."}, {"lang": "es", "value": "En casos excepcionales, el complemento Jenkins Plain Credentials 182.v468b_97b_9dcb_8 y versiones anteriores almacena las credenciales de archivos secretos sin cifrar (solo codificados en Base64) en el sistema de archivos del controlador Jenkins, donde pueden ser vistos por usuarios con acceso al sistema de archivos del controlador Jenkins (credenciales globales) o con Permiso de objeto/lectura extendida (credenciales con \u00e1mbito de carpeta)."}], "lastModified": "2025-10-10T15:26:09.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:plain_credentials:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "FE0A9E30-2ACA-4E5C-90E9-719B4FFA5B5C", "versionEndIncluding": "182.v468b_97b_9dcb_8"}], "operator": "OR"}]}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com"}