{"id":"CVE-2024-47805","published":"2024-10-02T15:35:03Z","modified":"2025-03-14T15:02:44Z","title":"Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact…","vendor":"Jenkins","product":"Jenkins Credentials Plugin","tier":"tail","description":{"text":"Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00591,"percentile":0.48118,"provenance":"source"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373","tags":["vendor-advisory"]}],"priority":{"score":14.9,"factors":[{"name":"EPSS percentile","points":9.62},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins Project","product":"Jenkins Credentials Plugin","versions":["<= 1380.va_435002fa_924"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","vulnerableRanges":[">=1372, <1381.v2c3a","<1371.1373.v4eb"],"patched":["1381.v2c3a","1371.1373.v4eb"],"from":["GHSA-62jv-j4w7-5hh8"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2957","exploited":false,"provenance":"source"}}