What is CVE-2024-39459?

CVE-2024-39459 is a medium-severity vulnerability in Jenkins Plain Credentials, classified under CWE-922. CVSS score: 4.3/10. Published 2024-06-26.

How severe is CVE-2024-39459?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2024-39459 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Jenkins Plain Credentials

CVE-2024-39459

In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).

EPSS: 0.004 (34.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Jenkins Plain_credentials
Jenkins Project Plain Credentials Plugin — versions 0

Weakness classification (CWE)

CWE-922

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

jenkinsci-cert@googlegroups.com (vendor-advisory, Vendor Advisory)
jenkinsci-cert@googlegroups.com (Mailing List)

Frequently asked questions

What is CVE-2024-39459?: CVE-2024-39459 is a medium-severity vulnerability in Jenkins Plain Credentials, classified under CWE-922. CVSS score: 4.3/10. Published 2024-06-26.
How severe is CVE-2024-39459?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2024-39459 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.