Sensitive Data Exposure in Jenkins Credentials Plugin by Jenkins
CVE-2024-47805

7.5HIGH

Key Information:

Vendor
Jenkins
Status
Credentials
Vendor
CVE Published:
2 October 2024

Summary

The Jenkins Credentials Plugin exposes sensitive data as it fails to properly redact encrypted credential values when accessing the item configuration file, config.xml, through the REST API or Command-Line Interface (CLI). This vulnerability compromises the integrity of credential management, allowing unauthorized access to sensitive information if the appropriate security measures are not implemented. Specific versions of the plugin are impacted, necessitating prompt action to mitigate the risks.

References

https://www.jenkins.io/security/advisory/2024-10-02/#SECU...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Collectors

NVD Database
.