Medium severity4.3NVD Advisory· Published Jun 26, 2024· Updated Jun 17, 2026
CVE-2024-39459
CVE-2024-39459
Description
In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:plain-credentialsMaven | < 183.va | 183.va |
Affected products
3- cpe:2.3:a:jenkins:plain_credentials:*:*:*:*:*:jenkins:*:*Range: <=182.v468b_97b_9dcb_8
- Range: 0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-3cpq-rw36-cppvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-39459ghsaADVISORY
- www.jenkins.io/security/advisory/2024-06-26/nvdVendor AdvisoryWEB
- www.openwall.com/lists/oss-security/2024/06/26/2nvdMailing ListWEB
- github.com/jenkinsci/plain-credentials-plugin/commit/ade8f1dd5a2bc69357995fd50baac56d73f80813ghsaWEB
News mentions
1- Jenkins Security Advisory 2024-06-26Jenkins Security Advisories · Jun 26, 2024