CVE-2024-47805 Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission

What is CVE-2024-47805?

CVE-2024-47805 is a high-severity vulnerability in Jenkins Credentials Plugin, published on 2 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.

Weakness: CWE-522

Which versions are affected by CVE-2024-47805?

4 open source packages ship an affected version, including org.jenkins-ci.plugins:credentials. It affects 1 product.

Products include Jenkins Credentials.

How do I fix CVE-2024-47805?

Upgrade org.jenkins-ci.plugins:credentials to a fixed version for your release line: 1371.1373.v4eb or 1381.v2c3a.

Is CVE-2024-47805 being exploited?

There is no known exploitation of CVE-2024-47805 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Credentials Plugin

• CVE-2021-21648 Cross-Site Request Forgery in Jenkins Credentials Plugin Medium 6.1
• CVE-2022-29036 Cross-site Scripting in Jenkins Credentials Plugin Medium 5.4
• CVE-2019-10320 Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-62jv-j4w7-5hh8.