CVE-2024-39459
mediumpriority · track · 0OT risk · elevatedEPSS 0.004 · 36 %ileDEEURUUSEPSS · scored 2026-10-28
In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
- jenkins plain credentials≤ 182.v468b_97b_9dcb_8nvdUScpe:2.3:a:jenkins:plain_credentials:*:*:*:*:*:*:*:*
- Maven org.jenkins-ci.plugins:plain-credentials< 183.vaosvUSpkg:maven/org.jenkins-ci.plugins/plain-credentials
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-1464Jenkins: Mehrere Schwachstellen ermöglichen Offenlegung von InformationenDeutsch2024-06-26csaf · cert_bundDE
Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Informationen offenzulegen.
- GHSA-3cpq-rw36-cppvSecret file credentials stored unencrypted in rare cases by Plain Credentials Plugin 2024-06-26ghsa · osvUS
When creating secret file credentials Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier attempts to decrypt the content of the file to check if it constitutes a valid encrypted secret. In rare cases the file content matches the expected format of an encrypted secret, and the file content will be stored unencrypted (only Base64 encoded) on the Jenkins controller file system. These credentials can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials). Plain Credentials Plugin 183.va_de8f1dd5a_2b_ no longer attempts to decrypt the content of the file when creating secret file credentials.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2024/06/26/2cnnvd
- https://access.redhat.com/security/cve/cve-2024-39459cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-39459/cnnvd
- https://vigilance.fr/vulnerability/Jenkins-Plugins-three-vulnerabilities-dated-26-06-2024-44604cnnvd
- https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495cnnvd
- http://www.openwall.com/lists/oss-security/2024/06/26/2enisa_euvd
- https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495enisa_euvd
- http://www.openwall.com/lists/oss-security/2024/06/26/2Mailing Listnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan