CVE-2024-28162 - Vulnerability Details

Vendors	Products
Jenkins	Delphix

Link	Providers
http://www.openwall.com/lists/oss-security/2024/03/06/3
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330

Type	Values Removed	Values Added
First Time appeared		Jenkins Jenkins delphix
CPEs		cpe:2.3:a:jenkins:delphix::::::jenkins::*
Vendors & Products		Jenkins Jenkins delphix

Type	Values Removed	Values Added
Weaknesses		CWE-295
Metrics		cvssV3_1 `{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-28162", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2024-03-05T19:29:05.205Z", "datePublished": "2024-03-06T17:02:02.667Z", "dateUpdated": "2025-02-13T17:47:25.492Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2024-05-01T18:06:31.346Z"}, "affected": [{"vendor": "Jenkins Project", "product": "Jenkins Delphix Plugin", "versions": [{"version": "3.0.1", "versionType": "maven", "lessThanOrEqual": "3.1.0", "status": "affected"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections fails to take effect until Jenkins is restarted when switching from disabled validation to enabled validation."}], "references": [{"name": "Jenkins Security Advisory 2024-03-06", "url": "https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/3"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-295", "lang": "en", "description": "CWE-295 Improper Certificate Validation"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-03-07T16:28:35.423603Z", "id": "CVE-2024-28162", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T15:17:24.540Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:49.411Z"}, "title": "CVE Program Container", "references": [{"name": "Jenkins Security Advisory 2024-03-06", "url": "https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/3", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-28162 (string)

assignerOrgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

state : PUBLISHED (string)

assignerShortName : jenkins (string)

dateReserved : 2024-03-05T19:29:05.205Z (string)

datePublished : 2024-03-06T17:02:02.667Z (string)

dateUpdated : 2025-02-13T17:47:25.492Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

shortName : jenkins (string)

dateUpdated : 2024-05-01T18:06:31.346Z (string)

}

affected : [ »

0 : { »

vendor : Jenkins Project (string)

product : Jenkins Delphix Plugin (string)

versions : [ »

0 : { »

version : 3.0.1 (string)

versionType : maven (string)

lessThanOrEqual : 3.1.0 (string)

status : affected (string)

}

]

defaultStatus : unaffected (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections fails to take effect until Jenkins is restarted when switching from disabled validation to enabled validation. (string)

}

]

references : [ »

0 : { »

name : Jenkins Security Advisory 2024-03-06 (string)

url : https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330 (string)

tags : [ »

0 : vendor-advisory (string)

]

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2024/03/06/3 (string)

}

]

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-295 (string)

lang : en (string)

description : CWE-295 Improper Certificate Validation (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.2 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-03-07T16:28:35.423603Z (string)

id : CVE-2024-28162 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-12T15:17:24.540Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T00:48:49.411Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : Jenkins Security Advisory 2024-03-06 (string)

url : https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2024/03/06/3 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-28162", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2024-03-05T19:29:05.205Z", "datePublished": "2024-03-06T17:02:02.667Z", "dateUpdated": "2024-11-12T15:17:24.540Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2024-03-06T17:02:02.667Z"}, "affected": [{"vendor": "Jenkins Project", "product": "Jenkins Delphix Plugin", "versions": [{"version": "3.0.1", "versionType": "maven", "lessThanOrEqual": "3.1.0", "status": "affected"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections fails to take effect until Jenkins is restarted when switching from disabled validation to enabled validation."}], "references": [{"name": "Jenkins Security Advisory 2024-03-06", "url": "https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/3"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:49.411Z"}, "title": "CVE Program Container", "references": [{"name": "Jenkins Security Advisory 2024-03-06", "url": "https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/3", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-28162", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-07T16:28:35.423603Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:16.331Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-28162 (string)

assignerOrgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

state : PUBLISHED (string)

assignerShortName : jenkins (string)

dateReserved : 2024-03-05T19:29:05.205Z (string)

datePublished : 2024-03-06T17:02:02.667Z (string)

dateUpdated : 2024-11-12T15:17:24.540Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

shortName : jenkins (string)

dateUpdated : 2024-03-06T17:02:02.667Z (string)

}

affected : [ »

0 : { »

vendor : Jenkins Project (string)

product : Jenkins Delphix Plugin (string)

versions : [ »

0 : { »

version : 3.0.1 (string)

versionType : maven (string)

lessThanOrEqual : 3.1.0 (string)

status : affected (string)

}

]

defaultStatus : unaffected (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections fails to take effect until Jenkins is restarted when switching from disabled validation to enabled validation. (string)

}

]

references : [ »

0 : { »

name : Jenkins Security Advisory 2024-03-06 (string)

url : https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330 (string)

tags : [ »

0 : vendor-advisory (string)

]

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2024/03/06/3 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T00:48:49.411Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : Jenkins Security Advisory 2024-03-06 (string)

url : https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2024/03/06/3 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.2 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-28162 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-03-07T16:28:35.423603Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-295 (string)

description : CWE-295 Improper Certificate Validation (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-05-23T19:01:16.331Z (string)

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:delphix:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "3DE811F3-62AA-4BDB-BA19-CFD6D0CFC35B", "versionEndExcluding": "3.1.1", "versionStartIncluding": "3.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections fails to take effect until Jenkins is restarted when switching from disabled validation to enabled validation."}, {"lang": "es", "value": "En Jenkins Delphix Plugin 3.0.1 a 3.1.0 (ambos inclusive), una opci\u00f3n global para que los administradores habiliten o deshabiliten la validaci\u00f3n de certificados SSL/TLS para conexiones de la Torre de control de datos (DCT) no surte efecto hasta que se reinicia al cambiar de validaci\u00f3n deshabilitada a validaci\u00f3n habilitada."}], "id": "CVE-2024-28162", "lastModified": "2025-05-07T14:27:52.307", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-03-06T17:15:11.140", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2024/03/06/3"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2024/03/06/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:jenkins:delphix:*:*:*:*:*:jenkins:*:* (string)

matchCriteriaId : 3DE811F3-62AA-4BDB-BA19-CFD6D0CFC35B (string)

versionEndExcluding : 3.1.1 (string)

versionStartIncluding : 3.0.1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections fails to take effect until Jenkins is restarted when switching from disabled validation to enabled validation. (string)

}

1 : { »

lang : es (string)

value : En Jenkins Delphix Plugin 3.0.1 a 3.1.0 (ambos inclusive), una opción global para que los administradores habiliten o deshabiliten la validación de certificados SSL/TLS para conexiones de la Torre de control de datos (DCT) no surte efecto hasta que se reinicia al cambiar de validación deshabilitada a validación habilitada. (string)

}

]

id : CVE-2024-28162 (string)

lastModified : 2025-05-07T14:27:52.307 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.2 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 2.5 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-03-06T17:15:11.140 (string)

references : [ »

0 : { »

source : jenkinsci-cert@googlegroups.com (string)

tags : [ »

0 : Mailing List (string)

]

url : http://www.openwall.com/lists/oss-security/2024/03/06/3 (string)

}

1 : { »

source : jenkinsci-cert@googlegroups.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

]

url : http://www.openwall.com/lists/oss-security/2024/03/06/3 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330 (string)

}

]

sourceIdentifier : jenkinsci-cert@googlegroups.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-295 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object