CVE-2024-39459

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39459
In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/06/26/2
https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495
http://www.openwall.com/lists/oss-security/2024/06/26/2
https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495
Configurations

No configuration.

History

21 Nov 2024, 09:27

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/06/26/2 - () http://www.openwall.com/lists/oss-security/2024/06/26/2 -
References () https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495 - () https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495 -

01 Nov 2024, 17:35

Type Values Removed Values Added
CWE CWE-922
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3

27 Jun 2024, 12:47

Type Values Removed Values Added
Summary
  • (es) En casos excepcionales, el complemento Jenkins Plain Credentials 182.v468b_97b_9dcb_8 y versiones anteriores almacena las credenciales de archivos secretos sin cifrar (solo codificados en Base64) en el sistema de archivos del controlador Jenkins, donde pueden ser vistos por usuarios con acceso al sistema de archivos del controlador Jenkins (credenciales globales) o con Permiso de objeto/lectura extendida (credenciales con ámbito de carpeta).

26 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/06/26/2 -

26 Jun 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-26 17:15

Updated : 2024-11-21 09:27

NVD link : CVE-2024-39459

Mitre link : CVE-2024-39459

CVE.ORG link : CVE-2024-39459

JSON object : View

Products Affected

No product.

CWE
CWE-922

Insecure Storage of Sensitive Information