PT-2024-4650 · Jenkins · Jenkins Structs Plugin+1

Juan Pablo Santos

·

Published

2024-06-18

·

Updated

2025-10-10

·

CVE-2024-39458

CVSS v3.1

3.1

Low

VectorAV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Jenkins Structs Plugin versions 337.v1b 04ea 4df7c8 and earlier
Description: The issue is related to the accidental exposure of secrets through the default system log when the Jenkins Structs Plugin fails to configure a build step. This happens because the plugin logs a warning message containing diagnostic information that may include secrets passed as step parameters. The exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information.
Recommendations: For Jenkins Structs Plugin versions 337.v1b 04ea 4df7c8 and earlier, update to version 338.v848422169819 or later, which inspects the types of actual parameters before logging warning messages and limits detailed diagnostic information to FINE level log messages if secrets are involved, preventing their display in the default Jenkins system log.

Fix

Generation of Error Message Containing Sensitive Information

Information Disclosure

Insertion into Log File

Weakness Enumeration

CWE-209CWE-200CWE-532

Related Identifiers

BDU:2024-05158
CVE-2024-39458
GHSA-XFX3-CR74-X3CV

Affected Products

Jenkins
Jenkins Structs Plugin