{
  "threat_severity" : "Moderate",
  "public_date" : "2024-06-26T00:00:00Z",
  "bugzilla" : {
    "description" : "jenkins: plain-credentials: Improper storage of credentials",
    "id" : "2294463",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2294463"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
    "status" : "draft"
  },
  "cwe" : "CWE-256",
  "details" : [ "In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).", "A vulnerability was found in the Jenkins Plain Credentials Plugin, which stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system. Users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials) can view these files." ],
  "package_state" : [ {
    "product_name" : "OpenShift Developer Tools and Services",
    "fix_state" : "Will not fix",
    "package_name" : "jenkins-2-plugins",
    "cpe" : "cpe:/a:redhat:ocp_tools"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "jenkins-2-plugins",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-39459\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-39459\nhttp://www.openwall.com/lists/oss-security/2024/06/26/2\nhttps://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495" ],
  "name" : "CVE-2024-39459",
  "csaw" : false
}