Information disclosure in Jenkins and Jenkins LTS - CVE-2024-47803

Vulnerability identifier: #VU98063

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-47803

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected application does not redact multi-line secret values in error messages generated for form submissions involving the "secretTextarea" form field. A remote user can gain unauthorized access to sensitive information on the system.

Jenkins
Jenkins LTS
OpenShift Developer Tools and Services
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)

Install updates from vendor's website.

Jenkins - update to 2.479
Jenkins LTS - update to 2.462.3
jenkins (Red Hat package) - addressed in versions 2.462.3.1729837947-3.el8, 2.462.3.1729839727-3.el8, 2.462.3.1729839924-3.el8, 2.462.3.1730119132-3.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 4.12.1730119231-1.el8, 4.13.1729840148-1.el8, 4.14.1729839844-1.el8, 4.15.1729838165-1.el8

• https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3451

• Multiple vulnerabilities in Jenkins and Jenkins LTS
• Red Hat Product OCP Tools 4 update for Openshift Jenkins
• Red Hat Product OCP Tools 4 update for Openshift Jenkins
• Red Hat Product OCP Tools 4 update for Openshift Jenkins
• Red Hat Product OCP Tools 4 update for Openshift Jenkins