Information Disclosure in Jenkins Due to Unredacted Multi-Line Secrets

CVE-2024-47803

What is CVE-2024-47803?

A vulnerability in Jenkins allows for the potential disclosure of sensitive multi-line secret values in error messages. When users submit forms that involve the secretTextarea form field, the system fails to appropriately redact the secrets, exposing confidential information unintentionally. This flaw affects Jenkins versions 2.478 and earlier and LTS version 2.462.2 and earlier, thus representing a risk for users who manage sensitive data within their Jenkins environments. It underscores the need for immediate action to mitigate risks associated with accidental information leakage.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References