CVE-2024-39459 Secret file credentials stored unencrypted in rare cases by Plain Credentials Plugin
Attackers with file system or extended read access can view unencrypted secret credentials stored by the Jenkins Plain Credentials Plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39459?
CVE-2024-39459 is a medium-severity vulnerability in Jenkins Plain Credentials Plugin, published on 26 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).
Weakness: CWE-922
Which versions are affected by CVE-2024-39459?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:plain-credentials. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:plain-credentials Maven | All versions | 183.va |
org.jenkins-ci.plugins:plain-credentials Maven | All versions | 183.va |
Products include Jenkins Plain Credentials.
How do I fix CVE-2024-39459?
Upgrade org.jenkins-ci.plugins:plain-credentials to 183.va or later.
Is CVE-2024-39459 being exploited?
There is no known exploitation of CVE-2024-39459 in the wild and no public exploit code.
Sources
Also known as GHSA-3cpq-rw36-cppv.