CVE-2024-39458

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39458
When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secrets passed as step parameters, potentially resulting in accidental exposure of secrets through the default system log.

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/06/26/2 Mailing List
https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3371 Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/06/26/2 Mailing List
https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3371 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:structs:*:*:*:*:*:jenkins:*:*
History

10 Oct 2025, 15:34

Type Values Removed Values Added
First Time Jenkins
Jenkins structs
CPE cpe:2.3:a:jenkins:structs:*:*:*:*:*:jenkins:*:*
References () http://www.openwall.com/lists/oss-security/2024/06/26/2 - () http://www.openwall.com/lists/oss-security/2024/06/26/2 - Mailing List
References () https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3371 - () https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3371 - Vendor Advisory

21 Nov 2024, 09:27

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/06/26/2 - () http://www.openwall.com/lists/oss-security/2024/06/26/2 -
References () https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3371 - () https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3371 -

05 Nov 2024, 21:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.1
CWE CWE-209

27 Jun 2024, 12:47

Type Values Removed Values Added
Summary
  • (es) Cuando el complemento Jenkins Structs 337.v1b_04ea_4df7c8 y versiones anteriores no logra configurar un paso de compilación, registra un mensaje de advertencia que contiene información de diagnóstico que puede contener secretos pasados como parámetros de paso, lo que podría provocar la exposición accidental de secretos a través del registro predeterminado del sistema.

26 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/06/26/2 -

26 Jun 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-26 17:15

Updated : 2025-10-10 15:34

NVD link : CVE-2024-39458

Mitre link : CVE-2024-39458

CVE.ORG link : CVE-2024-39458

JSON object : View

Products Affected

jenkins

  • structs
CWE
CWE-209

Generation of Error Message Containing Sensitive Information