CVE-2024-39459

2024-06-2704:23:36

redhat.com

access.redhat.com

cve-2024-39459

jenkins plain credentials plugin

secret file credentials

unencrypted

base64 encoded

jenkins controller file system

global credentials

item/extended read permission

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

A vulnerability was found in the Jenkins Plain Credentials Plugin, which stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system. Users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials) can view these files.