CVE-2024-47805

Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:jenkins:credentials::::::jenkins::*
	cpe:2.3:a:jenkins:credentials::::::jenkins::*

History

13 Nov 2024, 17:32

Type	Values Removed	Values Added
CPE		cpe:2.3:a:jenkins:credentials::::::jenkins::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~() https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373 -~~	() https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373 - Vendor Advisory
CWE		CWE-522
First Time		Jenkins credentials Jenkins

04 Oct 2024, 13:50

Type	Values Removed	Values Added
Summary		(es) El complemento de credenciales de Jenkins 1380.va_435002fa_924 y anteriores, excepto 1371.1373.v4eb_fa_b_7161e9, no redacta los valores cifrados de las credenciales que utilizan el tipo `SecretBytes` al acceder al elemento `config.xml` a través de la API REST o la CLI.

02 Oct 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-02 16:15

Updated : 2024-11-13 17:32

NVD link : CVE-2024-47805

Mitre link : CVE-2024-47805

CVE.ORG link : CVE-2024-47805

JSON object : View

Products Affected

jenkins

credentials

CWE

CWE-522

Insufficiently Protected Credentials

7.5 /10