CVE-2024-39459

Published: Jun 26, 2024Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).

Affected (1)

Products: Jenkins: Plain Credentials

1 product

Plain Credentials

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Plain Credentials	Up to 182.v468b_97b_9dcb_8

Related CWEs

Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

References (4)

http://www.openwall.com/lists/oss-security/2024/06/26/2

Source: jenkinsci-cert@googlegroups.com

Mailing List

https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2024/06/26/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.