CVE-2024-47805

Published: Oct 2, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.

Affected (2)

Products: Jenkins: Credentials

Jenkins

1 product

Credentials

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Jenkins Credentials	Before 1371.1373.v4eb_fa_b_7161e9
Jenkins Credentials	From 1371.vfee6b_095f0a_3 to 1380.va_435002fa_924

Related CWEs

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (1)

https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

Timeline

No history available yet.