CVE-2024-47805 - Vulnerability Details

Vendors	Products
Jenkins	Credentials

Link	Providers
https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
First Time appeared		Jenkins Jenkins credentials
Weaknesses		CWE-522
CPEs		cpe:2.3:a:jenkins:credentials::::::jenkins::*
Vendors & Products		Jenkins Jenkins credentials
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.
References		https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47805", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2024-10-01T20:59:52.483Z", "datePublished": "2024-10-02T15:35:03.653Z", "dateUpdated": "2025-03-14T15:02:44.176Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2024-10-02T15:35:03.653Z"}, "affected": [{"vendor": "Jenkins Project", "product": "Jenkins Credentials Plugin", "versions": [{"version": "1371.1373.v4eb_fa_b_7161e9", "status": "unaffected"}, {"version": "0", "versionType": "maven", "lessThanOrEqual": "1380.va_435002fa_924", "status": "affected"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI."}], "references": [{"name": "Jenkins Security Advisory 2024-10-02", "url": "https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373", "tags": ["vendor-advisory"]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-522", "lang": "en", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-14T15:02:05.194480Z", "id": "CVE-2024-47805", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T15:02:44.176Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-47805 (string)

assignerOrgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

state : PUBLISHED (string)

assignerShortName : jenkins (string)

dateReserved : 2024-10-01T20:59:52.483Z (string)

datePublished : 2024-10-02T15:35:03.653Z (string)

dateUpdated : 2025-03-14T15:02:44.176Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

shortName : jenkins (string)

dateUpdated : 2024-10-02T15:35:03.653Z (string)

}

affected : [ »

0 : { »

vendor : Jenkins Project (string)

product : Jenkins Credentials Plugin (string)

versions : [ »

0 : { »

version : 1371.1373.v4eb_fa_b_7161e9 (string)

status : unaffected (string)

}

1 : { »

version : 0 (string)

versionType : maven (string)

lessThanOrEqual : 1380.va_435002fa_924 (string)

status : affected (string)

}

]

defaultStatus : unaffected (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI. (string)

}

]

references : [ »

0 : { »

name : Jenkins Security Advisory 2024-10-02 (string)

url : https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373 (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-522 (string)

lang : en (string)

description : CWE-522 Insufficiently Protected Credentials (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-03-14T15:02:05.194480Z (string)

id : CVE-2024-47805 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-14T15:02:44.176Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-47805", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-14T15:02:05.194480Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T16:30:33.317Z"}}], "cna": {"affected": [{"vendor": "Jenkins Project", "product": "Jenkins Credentials Plugin", "versions": [{"status": "unaffected", "version": "1371.1373.v4eb_fa_b_7161e9"}, {"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "1380.va_435002fa_924"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373", "name": "Jenkins Security Advisory 2024-10-02", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2024-10-02T15:35:03.653Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47805", "state": "PUBLISHED", "dateUpdated": "2025-03-14T15:02:44.176Z", "dateReserved": "2024-10-01T20:59:52.483Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2024-10-02T15:35:03.653Z", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-47805 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-03-14T15:02:05.194480Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-522 (string)

description : CWE-522 Insufficiently Protected Credentials (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-02T16:30:33.317Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Jenkins Project (string)

product : Jenkins Credentials Plugin (string)

versions : [ »

0 : { »

status : unaffected (string)

version : 1371.1373.v4eb_fa_b_7161e9 (string)

}

1 : { »

status : affected (string)

version : 0 (string)

versionType : maven (string)

lessThanOrEqual : 1380.va_435002fa_924 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373 (string)

name : Jenkins Security Advisory 2024-10-02 (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI. (string)

}

]

providerMetadata : { »

orgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

shortName : jenkins (string)

dateUpdated : 2024-10-02T15:35:03.653Z (string)

}

cveMetadata : { »

cveId : CVE-2024-47805 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-14T15:02:44.176Z (string)

dateReserved : 2024-10-01T20:59:52.483Z (string)

assignerOrgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

datePublished : 2024-10-02T15:35:03.653Z (string)

assignerShortName : jenkins (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:credentials:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "750A4477-7765-483C-BBF7-5379B3F36A3A", "versionEndExcluding": "1371.1373.v4eb_fa_b_7161e9", "vulnerable": true}, {"criteria": "cpe:2.3:a:jenkins:credentials:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "D11B52B7-4533-4C09-8C73-68E2372CC228", "versionEndExcluding": "1380.va_435002fa_924", "versionStartIncluding": "1371.vfee6b_095f0a_3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI."}, {"lang": "es", "value": "El complemento de credenciales de Jenkins 1380.va_435002fa_924 y anteriores, excepto 1371.1373.v4eb_fa_b_7161e9, no redacta los valores cifrados de las credenciales que utilizan el tipo `SecretBytes` al acceder al elemento `config.xml` a trav\u00e9s de la API REST o la CLI."}], "id": "CVE-2024-47805", "lastModified": "2025-03-14T15:15:43.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-10-02T16:15:10.753", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:jenkins:credentials:*:*:*:*:*:jenkins:*:* (string)

matchCriteriaId : 750A4477-7765-483C-BBF7-5379B3F36A3A (string)

versionEndExcluding : 1371.1373.v4eb_fa_b_7161e9 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:jenkins:credentials:*:*:*:*:*:jenkins:*:* (string)

matchCriteriaId : D11B52B7-4533-4C09-8C73-68E2372CC228 (string)

versionEndExcluding : 1380.va_435002fa_924 (string)

versionStartIncluding : 1371.vfee6b_095f0a_3 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI. (string)

}

1 : { »

lang : es (string)

value : El complemento de credenciales de Jenkins 1380.va_435002fa_924 y anteriores, excepto 1371.1373.v4eb_fa_b_7161e9, no redacta los valores cifrados de las credenciales que utilizan el tipo `SecretBytes` al acceder al elemento `config.xml` a través de la API REST o la CLI. (string)

}

]

id : CVE-2024-47805 (string)

lastModified : 2025-03-14T15:15:43.840 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-10-02T16:15:10.753 (string)

references : [ »

0 : { »

source : jenkinsci-cert@googlegroups.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373 (string)

}

]

sourceIdentifier : jenkinsci-cert@googlegroups.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-522 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-522 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object