CVE-2024-47803
Jenkins exposes multi-line secrets through error messages
Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field.
- Record
CVE-2024-47803- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
CVE List
Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field.
- Record
CVE-2024-47803- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2024-3100
Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field.
- Record
EUVD-2024-3100- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pj95-ph4q-4qm4
Jenkins exposes multi-line secrets through error messages
Jenkins
Jenkins provides the secretTextarea form field for multi-line secrets.
Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field.
This can result in exposure of multi-line secrets through those error messages, e.g., in the system log.
Jenkins 2.479, LTS 2.462.3 redacts multi-line secret values in error messages generated for form submissions involving the secretTextarea form field.
- Record
GHSA-pj95-ph4q-4qm4- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV
Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field.
- Record
CVE-2024-47803- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-pj95-ph4q-4qm4
Jenkins exposes multi-line secrets through error messages
Jenkins
Jenkins provides the secretTextarea form field for multi-line secrets.
Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field.
This can result in exposure of multi-line secrets through those error messages, e.g., in the system log.
Jenkins 2.479, LTS 2.462.3 redacts multi-line secret values in error messages generated for form submissions involving the secretTextarea form field.
- Record
GHSA-pj95-ph4q-4qm4- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2024:8884
Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 Openshift Jenkins security update
- Record
RHSA-2024:8884- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2024:8885
Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update
- Record
RHSA-2024:8885- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2024:8886
Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update
- Record
RHSA-2024:8886- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:8887
Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 Openshift Jenkins security update
- Record
RHSA-2024:8887- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVBIT-jenkins-2024-47803 No score
Jenkins LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field.
- Record
BIT-jenkins-2024-47803- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
before 2.462.3 | 2.462.3 |
org.jenkins-ci.main:jenkins-coreMaven |
2.466 up to 2.479 | 2.479 |
jenkinsBitnami |
before 2.462.3 | 2.462.3 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.462.3, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.462.3 |
org.jenkins-ci.main:jenkins-coreMaven |
2.466 up to 2.479, plus listed versions 2.4672.4682.4692.4702.471 Show 7 moreShow less2.4722.4732.4742.4752.4762.4772.478 |
2.479 |
jenkinsRed Hat:ocp_tools:4.15::el8 From an advisory covering 4 CVEs |
before 0:2.462.3.1729837947-3.el8 | 0:2.462.3.1729837947-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.15::el8 From an advisory covering 4 CVEs |
before 0:4.15.1729838165-1.el8 | 0:4.15.1729838165-1.el8 |
jenkinsRed Hat:ocp_tools:4.14::el8 From an advisory covering 4 CVEs |
before 0:2.462.3.1729839727-3.el8 | 0:2.462.3.1729839727-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.14::el8 From an advisory covering 4 CVEs |
before 0:4.14.1729839844-1.el8 | 0:4.14.1729839844-1.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 From an advisory covering 5 CVEs |
before 0:2.462.3.1730119132-3.el8 | 0:2.462.3.1730119132-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 From an advisory covering 5 CVEs |
before 0:4.12.1730119231-1.el8 | 0:4.12.1730119231-1.el8 |
jenkinsRed Hat:ocp_tools:4.13::el8 From an advisory covering 4 CVEs |
before 0:2.462.3.1729839924-3.el8 | 0:2.462.3.1729839924-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.13::el8 From an advisory covering 4 CVEs |
before 0:4.13.1729840148-1.el8 | 0:4.13.1729840148-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47803 is a medium vulnerability (CVSS 4.3) in Jenkins, published October 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.462.3.
References
jenkins.io/security/advisory/2024-10-02
nvd.nist.gov/vuln/detail/CVE-2024-47803
github.com/advisories/GHSA-pj95-ph4q-4qm4
access.redhat.com/errata/RHSA-2024:8884
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8884.json
Show 28 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2315808
cve.org/CVERecord?id=CVE-2021-44549
spring.io/security/cve-2024-38808
openwall.com/lists/oss-security/2024/05/02/3
Left out here: 852 versions. The JSON record has them.