{"id":"CVE-2024-47805","aliases":["EUVD-2024-2957","GHSA-62jv-j4w7-5hh8"],"status":"published","title":"Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission","description":"Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00591,"percentile":0.48703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-522"],"published":"2024-10-02T15:35:03Z","modified":"2026-10-24T14:38:04Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","fixed_in":["1371.1373.v4eb","1381.v2c3a"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1371.1373.v4eb"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1372"},{"fixed":"1381.v2c3a"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1372"},{"fixed":"1381.v2c3a"}]}],"versions":["1378.v81ef4269d764","1380.va_435002fa_924"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1371.1373.v4eb"}]}],"versions":["1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.16.1","1.17","1.18","1.19","1.2","1.20","1.21","1.22","1.23","1.24","1.25","1.26","1.27","1.28","1.3","1.3.1","1.4","1.5","1.6","1.7","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","1.9.4","1055.v1346ba467ba1","1061.vb_1fceb_58fa_18","1074.1076.v39c30cecb_0e2","1074.v60e6c29b_b_44b_","1087.1089.v2f1b_9a_b_040e4","1087.v16065d268466","1105.vb_4e24a_c78b_81","1111.v35a_307992395","1112.vc87b_7a_3597f6","1118.v320cd028cb_a_0","1126.ve05618c41e62","1129.vef26f5df883c","1139.veb_9579fca_33b_","1143.vb_e8b_b_ceee347","1189.vf61b_a_5e2f62e","1214.v1de940103927","1224.vc23ca_a_9a_2cb_0","1236.v31e44e6060c0","1254.vb_96f366e7b_a_d","1268.v3f0d043d60e9","1271.v54b_1c2c6388a_","1290.v2e5b_13eb_b_127","1293.vff276f713473","1304.v5ec13eecef46","1305.v04f5ec1f3743","1307.v3757c78f17c3","1309.v8835d63eb_d8a_","1311.vcf0a_900b_37c2","1317.v0ce519a_92b_3e","1319.v7eb_51b_3a_c97b_","1337.v60b_d7b_c7b_c9f","1344.v5a_3f65a_1e173","1350.v1b_df4d227d1b_","1355.v46f52a_b_98d64","1361.v56f5ca_35d21c","1371.vfee6b_095f0a_3","2.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.18","2.1.19","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.3.0","2.3.0.1","2.3.1","2.3.10","2.3.11","2.3.12","2.3.13","2.3.13.1","2.3.14","2.3.14.1","2.3.15","2.3.15.1","2.3.17","2.3.18","2.3.19","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.7.1","2.3.8","2.3.9","2.4","2.4.0.1","2.4.1","2.5","2.6","2.6.1","2.6.1.1","2.6.2"]}],"products":[{"vendor":"jenkins","product":"credentials"},{"vendor":"jenkins project","product":"jenkins credentials plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47805","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-62jv-j4w7-5hh8"}],"sources":{"cve":[{"id":"CVE-2024-47805","description":"Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.","status":"published","published":"2024-10-02T15:35:03.653Z","modified":"2025-03-14T15:02:44.176Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:33:57.302325Z"}],"euvd":[{"id":"EUVD-2024-2957","description":"Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.","status":"published","published":"2024-10-02T15:35:03Z","modified":"2025-03-14T15:02:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:03.250545Z"}],"ghsa":[{"id":"GHSA-62jv-j4w7-5hh8","title":"Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission","description":"Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type (e.g., Certificate credentials, or Secret file credentials from Plain Credentials Plugin) when accessing item `config.xml` via REST API or CLI.\n\nThis allows attackers with Item/Extended Read permission to view encrypted `SecretBytes` values in credentials.\n\nThis issue is similar to SECURITY-266 in the 2016-05-11 security advisory, which applied to the `Secret` type used for inline secrets and some credentials types.\n\nCredentials Plugin 1381.v2c3a_12074da_b_ redacts the encrypted values of credentials using the `SecretBytes` type in item `config.xml` files.\n\nThis fix is only effective on Jenkins 2.479 and newer, LTS 2.462.3 and newer. While Credentials Plugin 1381.v2c3a_12074da_b_ can be installed on Jenkins 2.463 through 2.478 (both inclusive), encrypted values of credentials using the `SecretBytes` type will not be redacted when accessing item `config.xml` via REST API or CLI. ","status":"published","published":"2024-10-02T18:31:32Z","modified":"2024-11-13T18:52:52Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:38:17.357217Z"}],"nvd":[{"id":"CVE-2024-47805","description":"Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.","status":"published","published":"2024-10-02T16:15:10.753Z","modified":"2026-06-17T07:57:47.05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:10:30.673028Z"}],"osv":[{"id":"CVE-2024-47805","description":"Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.","status":"published","published":"2024-10-02T16:15:10.753Z","modified":"2026-10-24T14:38:04.685720585Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"GHSA-62jv-j4w7-5hh8","title":"Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission","description":"Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type (e.g., Certificate credentials, or Secret file credentials from Plain Credentials Plugin) when accessing item `config.xml` via REST API or CLI.\n\nThis allows attackers with Item/Extended Read permission to view encrypted `SecretBytes` values in credentials.\n\nThis issue is similar to SECURITY-266 in the 2016-05-11 security advisory, which applied to the `Secret` type used for inline secrets and some credentials types.\n\nCredentials Plugin 1381.v2c3a_12074da_b_ redacts the encrypted values of credentials using the `SecretBytes` type in item `config.xml` files.\n\nThis fix is only effective on Jenkins 2.479 and newer, LTS 2.462.3 and newer. While Credentials Plugin 1381.v2c3a_12074da_b_ can be installed on Jenkins 2.463 through 2.478 (both inclusive), encrypted values of credentials using the `SecretBytes` type will not be redacted when accessing item `config.xml` via REST API or CLI. ","status":"published","published":"2024-10-02T18:31:32Z","modified":"2024-11-13T19:23:47.855908Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}