CVE-2024-47805: Infoleak
Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type (e.g., Certificate credentials, or Secret file credentials from Plain Credentials Plugin) when accessing item config.xml via REST API or CLI.
This allows attackers with Item/Extended Read permission to view encrypted SecretBytes values in credentials.
This issue is similar to SECURITY-266 in the 2016-05-11 security advisory, which applied to the Secret type used for inline secrets and some credentials types.
Credentials Plugin 1381.v2c3a12074dab redacts the encrypted values of credentials using the SecretBytes type in item config.xml files.
This fix is only effective on Jenkins 2.479 and newer, LTS 2.462.3 and newer. While Credentials Plugin 1381.v2c3a12074dab can be installed on Jenkins 2.463 through 2.478 (both inclusive), encrypted values of credentials using the SecretBytes type will not be redacted when accessing item config.xml via REST API or CLI.
Other sources
Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type when accessing item config.xml via REST API or CLI.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47805?
CVE-2024-47805 is considered a high severity vulnerability due to the exposure of encrypted credential values.
How do I fix CVE-2024-47805?
To fix CVE-2024-47805, you should upgrade to Jenkins Credentials Plugin version 1381.v2c3a or 1371.1373.v4eb.
What type of credentials are affected by CVE-2024-47805?
CVE-2024-47805 affects credentials of the 'SecretBytes' type, such as Certificate and Secret file credentials.
In which versions of Jenkins Credentials Plugin is CVE-2024-47805 present?
CVE-2024-47805 is present in Jenkins Credentials Plugin versions up to and including 1380.va_435002fa_924.
What is the impact of CVE-2024-47805 on Jenkins instances?
The impact of CVE-2024-47805 allows unauthorized access to sensitive credential information through the item config.xml.