CVE-2024-28162: 
Java vulnerability analysis and mitigation

CVE-2024-28162 affects the Jenkins Delphix Plugin versions 3.0.1 through 3.1.0. The vulnerability is related to a global configuration option that allows administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections. The issue was discovered and disclosed on March 6, 2024 (Jenkins Advisory).

The vulnerability stems from an implementation flaw in the SSL/TLS certificate validation functionality. When administrators switch the global configuration from disabled validation to enabled validation, the change fails to take effect immediately and requires a Jenkins restart to be applied (Jenkins Advisory). The vulnerability has been assigned a Medium severity rating according to CVSS v3.1 with a base score of 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) (NVD).

The impact of this vulnerability is that even after an administrator enables SSL/TLS certificate validation, the system continues to operate with disabled validation until Jenkins is restarted. This creates a window of vulnerability where connections remain insecure despite the configuration change (Jenkins Advisory).

The vulnerability requires no special privileges to exploit, though it only affects scenarios where an administrator changes the SSL/TLS certificate validation setting from disabled to enabled. The issue is specifically tied to the configuration change process (Jenkins Advisory).

The vulnerability has been fixed in Delphix Plugin version 3.1.1, which applies the configuration change immediately when switching from disabled validation to enabled validation. Users are advised to upgrade to this version to address the issue (Jenkins Advisory).