CVE-2024-39459 - Vulnerability Details - OpenCVE

In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Jenkins	Plain Credentials

Configuration 1 [-]

cpe:2.3:a:jenkins:plain_credentials:*:*:*:*:*:jenkins:*:*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/06/26/2
https://nvd.nist.gov/vuln/detail/CVE-2024-39459
https://www.cve.org/CVERecord?id=CVE-2024-39459
https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495

History

Fri, 10 Oct 2025 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jenkins Jenkins plain Credentials
CPEs		cpe:2.3:a:jenkins:plain_credentials::::::jenkins::*
Vendors & Products		Jenkins Jenkins plain Credentials

Fri, 01 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-922
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: jenkins

Published: 2024-06-26T17:06:27.043Z

Updated: 2025-02-13T17:53:17.283Z

Reserved: 2024-06-25T08:12:57.626Z

Link: CVE-2024-39459

Vulnrichment

Updated: 2024-08-02T04:26:14.969Z

NVD

Status : Analyzed

Published: 2024-06-26T17:15:27.110

Modified: 2025-10-10T15:26:09.097

Link: CVE-2024-39459

Redhat

Severity : Moderate

Publid Date: 2024-06-26T00:00:00Z

Links: CVE-2024-39459 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-39459", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2024-06-25T08:12:57.626Z", "datePublished": "2024-06-26T17:06:27.043Z", "dateUpdated": "2025-02-13T17:53:17.283Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2024-06-26T17:10:07.771Z"}, "affected": [{"vendor": "Jenkins Project", "product": "Jenkins Plain Credentials Plugin", "versions": [{"version": "0", "versionType": "maven", "lessThanOrEqual": "182.v468b_97b_9dcb_8", "status": "affected"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials)."}], "references": [{"name": "Jenkins Security Advisory 2024-06-26", "url": "https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/06/26/2"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-922", "lang": "en", "description": "CWE-922 Insecure Storage of Sensitive Information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-26T18:32:42.860915Z", "id": "CVE-2024-39459", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-01T16:37:18.477Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:26:14.969Z"}, "title": "CVE Program Container", "references": [{"name": "Jenkins Security Advisory 2024-06-26", "url": "https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/06/26/2", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495", "name": "Jenkins Security Advisory 2024-06-26", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/06/26/2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:26:14.969Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-39459", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-26T18:32:42.860915Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-922", "description": "CWE-922 Insecure Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-26T18:32:47.678Z"}}], "cna": {"affected": [{"vendor": "Jenkins Project", "product": "Jenkins Plain Credentials Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "182.v468b_97b_9dcb_8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495", "name": "Jenkins Security Advisory 2024-06-26", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/06/26/2"}], "descriptions": [{"lang": "en", "value": "In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials)."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2024-06-26T17:10:07.771Z"}}}, "cveMetadata": {"cveId": "CVE-2024-39459", "state": "PUBLISHED", "dateUpdated": "2025-02-13T17:53:17.283Z", "dateReserved": "2024-06-25T08:12:57.626Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2024-06-26T17:06:27.043Z", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:plain_credentials:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "FE0A9E30-2ACA-4E5C-90E9-719B4FFA5B5C", "versionEndIncluding": "182.v468b_97b_9dcb_8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials)."}, {"lang": "es", "value": "En casos excepcionales, el complemento Jenkins Plain Credentials 182.v468b_97b_9dcb_8 y versiones anteriores almacena las credenciales de archivos secretos sin cifrar (solo codificados en Base64) en el sistema de archivos del controlador Jenkins, donde pueden ser vistos por usuarios con acceso al sistema de archivos del controlador Jenkins (credenciales globales) o con Permiso de objeto/lectura extendida (credenciales con \u00e1mbito de carpeta)."}], "id": "CVE-2024-39459", "lastModified": "2025-10-10T15:26:09.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-06-26T17:15:27.110", "references": [{"source": "[email protected]", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2024/06/26/2"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2024/06/26/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-922"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}