6.5

CVE-2024-9453: jenkins

CVSS: 6.5v3.1MediumAnalyzed
AliasesCGA-jr4p-m3cm-8gg3CGA-pj2r-977x-prh3CGA-2x6j-7qg7-p5p4
Published 04-07-2025Last modified 12-12-2025
Open JSON

Vulnerability summary

CVE-2024-9453 is a medium (CVSS 6.5) vulnerability in jenkins. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.9% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.40%
0%100%
Low · +0.05 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 6
CGA-5HF6-6R6P-W83GCGA-5PRM-G7P3-2HC5CGA-CJ23-5XC9-GMM7CGA-FG6M-2P28-RM5CCGA-GQVG-H46G-GPH2CGA-HF6X-RH82-W6XP

Timeline

  1. 04-07-2025
    PublishedVulnerability first disclosed.
  2. 12-12-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

+0.05 pp

From 0.35% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard6 products
  • jenkins-2All versions (No fix recorded)
  • jenkins-2.528All versions (No fix recorded)
  • jenkins-2.541All versions (No fix recorded)
  • jenkins-2.555All versions (No fix recorded)
  • jenkins-2.568All versions (No fix recorded)
Jenkins2 products
Wolfi1 product
  • jenkins-2All versions (No fix recorded)

3 vendors · 9 products

References

6 links