CVE-2024-28154: 
Java vulnerability analysis and mitigation

CVE-2024-28154 affects the Jenkins MQ Notifier Plugin versions 1.4.0 and earlier. The vulnerability relates to a default configuration where the plugin logs JSON payloads containing potentially sensitive build parameters to build logs without masking them (Jenkins Advisory, NVD). The vulnerability was disclosed on March 6, 2024, and has been assigned a CVSS v3.1 base score of 6.5 (Medium).

The vulnerability stems from a global configuration option in the MQ Notifier Plugin that enables logging of JSON payloads sent to RabbitMQ in the build log. This feature is enabled by default in affected versions, causing build parameters, including sensitive information, to be logged without proper masking (Jenkins Advisory). The CVSS v3.1 vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and high confidentiality impact (NVD).

The primary impact of this vulnerability is the potential exposure of sensitive information through build logs. Since the plugin logs build parameters as part of the JSON payload sent to RabbitMQ, any sensitive data included in these parameters could be exposed to unauthorized viewers of the build logs (Jenkins Advisory).

The vulnerability is exploitable in environments where the MQ Notifier Plugin version 1.4.0 or earlier is installed with its default configuration. Access to build logs would be required to view the exposed sensitive information (Jenkins Advisory).

The vulnerability has been fixed in MQ Notifier Plugin version 1.4.1. The fix disables the global option to log JSON payloads by default. When updating from a previous release, the option is automatically disabled and must be explicitly re-enabled by administrators who require this functionality (Jenkins Advisory).