GitHub Advisoryadvisory · Maven

GHSA-pj95-ph4q-4qm4 Jenkins exposes multi-line secrets through error messages

MEDIUM Published 2024-10-02 Modified 2025-03-20 Official page ↗
Aliases
CVE-2024-47803
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209
Reviewed
2024-10-02

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.462.3 → fixed in 2.462.3 • Maven org.jenkins-ci.main:jenkins-core: >= 2.466, < 2.479 → fixed in 2.479

Description

Jenkins Jenkins provides the `secretTextarea` form field for multi-line secrets. Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field. This can result in exposure of multi-line secrets through those error messages, e.g., in the system log. Jenkins 2.479, LTS 2.462.3 redacts multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.

Related

Alias · CVE (1)

  • CVE-2024-47803 Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form… vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References