CVE-2024-34148 - Vulnerability Details - OpenCVE

Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting the Java system property 'hudson.model.ParametersAction.keepUndefinedParameters'.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Jenkins	Jenkins

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/05/02/3
https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3331

History

Thu, 13 Feb 2025 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jenkins Jenkins jenkins
CPEs		cpe:2.3:a:jenkins:jenkins:-::::-:::
Vendors & Products		Jenkins Jenkins jenkins
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jenkins

Published: 2024-05-02T13:28:05.952Z

Updated: 2025-02-13T17:52:27.106Z

Reserved: 2024-04-30T20:53:08.612Z

Link: CVE-2024-34148

Vulnrichment

Updated: 2024-08-02T02:51:09.888Z

NVD

Status : Awaiting Analysis

Published: 2024-05-02T14:15:10.523

Modified: 2024-11-21T09:18:11.977

Link: CVE-2024-34148

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-34148", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2024-04-30T20:53:08.612Z", "datePublished": "2024-05-02T13:28:05.952Z", "dateUpdated": "2025-02-13T17:52:27.106Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2024-05-02T13:30:13.028Z"}, "affected": [{"vendor": "Jenkins Project", "product": "Jenkins Subversion Partial Release Manager Plugin", "versions": [{"version": "0", "versionType": "maven", "lessThanOrEqual": "1.0.1", "status": "affected"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting the Java system property 'hudson.model.ParametersAction.keepUndefinedParameters'."}], "references": [{"name": "Jenkins Security Advisory 2024-05-02", "url": "https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3331", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/3"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-34148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-02T17:26:03.865506Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jenkins:jenkins:-:*:*:*:-:*:*:*"], "vendor": "jenkins", "product": "jenkins", "versions": [{"status": "affected", "version": "1.0.1*", "versionType": "custom", "lessThanOrEqual": "1.0.1"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:42:07.420Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:51:09.888Z"}, "title": "CVE Program Container", "references": [{"name": "Jenkins Security Advisory 2024-05-02", "url": "https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3331", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/3", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3331", "name": "Jenkins Security Advisory 2024-05-02", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/3", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:51:09.888Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-34148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-02T17:26:03.865506Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jenkins:jenkins:-:*:*:*:-:*:*:*"], "vendor": "jenkins", "product": "jenkins", "versions": [{"status": "affected", "version": "1.0.1*", "versionType": "custom", "lessThanOrEqual": "1.0.1"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-02T17:25:18.707Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"affected": [{"vendor": "Jenkins Project", "product": "Jenkins Subversion Partial Release Manager Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "1.0.1"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3331", "name": "Jenkins Security Advisory 2024-05-02", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/3"}], "descriptions": [{"lang": "en", "value": "Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting the Java system property 'hudson.model.ParametersAction.keepUndefinedParameters'."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2024-05-02T13:30:13.028Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34148", "state": "PUBLISHED", "dateUpdated": "2025-02-13T17:52:27.106Z", "dateReserved": "2024-04-30T20:53:08.612Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2024-05-02T13:28:05.952Z", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}