SSL/TLS Certificate Validation Bypass in Jenkins Delphix Plugin
CVE-2024-28162

4.2MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Delphix Plugin
Vendor
CVE Published:
6 March 2024
đź”” Create Jenkins Vulnerability Alert

What is CVE-2024-28162?

In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections fails to take effect until Jenkins is restarted when switching from disabled validation to enabled validation.

Affected Version(s)

Jenkins Delphix Plugin 3.0.1 <= 3.1.0

References

https://www.jenkins.io/security/advisory/2024-03-06/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/03/06/3

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.