{"id":"CVE-2024-47805","details":"Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.","aliases":["GHSA-62jv-j4w7-5hh8"],"modified":"2026-07-09T16:45:00.662418Z","published":"2024-10-02T16:15:10.753Z","references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/credentials-plugin","events":[{"introduced":"0"},{"fixed":"4ebfab7161e93c51353dcf6224e8450b56009710"},{"introduced":"fee6b095f0a3750136c4ef905dbdc27ace358133"},{"fixed":"a435002fa924e90f7af9353b246c471edd118e96"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:credentials:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1371.1373.v4eb_fa_b_7161e9"},{"introduced":"1371.vfee6b_095f0a_3"},{"fixed":"1380.va_435002fa_924"}],"source":"CPE_RANGE"}}],"versions":["1378.v81ef4269d764","1371.vfee6b_095f0a_3"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/jenkinsci/credentials-plugin/commit/a435002fa924e90f7af9353b246c471edd118e96","target":{"file":"src/test/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest.java","function":"getContentFrom_doCheckUploadedKeystore"},"deprecated":false,"digest":{"function_hash":"164725225811388745913033261042041545474","length":723},"id":"CVE-2024-47805-6acd5eff","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["227789012663226576821697893368945104980","101243417522049580872775062737715680453","12982210172723552799732114508301167236","188000590521261785348956186216725969729","103365024988260552054976621924476322701","204491974520689226852159887961419587272","205620044847721228488468795622041493542"],"threshold":0.9},"id":"CVE-2024-47805-750a21eb","signature_type":"Line","signature_version":"v1","source":"https://github.com/jenkinsci/credentials-plugin/commit/a435002fa924e90f7af9353b246c471edd118e96","target":{"file":"src/main/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl.java"}},{"target":{"file":"src/test/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest.java"},"deprecated":false,"digest":{"line_hashes":["88357800292263496038010660281559623237","138183184243809333345261176689487106743","127420473234323119363526059319749082273","138835690480409494124222630800649178066"],"threshold":0.9},"id":"CVE-2024-47805-ab57bb01","signature_type":"Line","signature_version":"v1","source":"https://github.com/jenkinsci/credentials-plugin/commit/a435002fa924e90f7af9353b246c471edd118e96"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47805.json","vanir_signatures_modified":"2026-07-09T16:45:00Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}