CVE-2024-34148

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting the Java system property 'hudson.model.ParametersAction.keepUndefinedParameters'.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1321

Affected software

Vendor	Product	Versions
Jenkins Project	Jenkins Subversion Partial Release Manager Plugin	<= 1.0.1
jenkins	jenkins	>= 1.0.1*, <= 1.0.1

References

http://www.openwall.com/lists/oss-security/2024/05/02/3Mailing List
https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3331Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/05/02/3Mailing List
https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3331Vendor Advisory

Timeline

Published: May 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-341496.3In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2024-34154.8A vulnerability was found in SourceCodester Human Resource Information System 1.0. It has been classified as problematic. Affected is an unk CVE-2024-341524.3Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the CVE-2024-341537.8Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enabl CVE-2024-341554.3Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.CVE-2024-341567.5Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up t CVE-2024-341587.5Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.CVE-2024-34169.8A vulnerability classified as critical was found in SourceCodester Online Courseware 1.0. This vulnerability affects unknown code of the fil CVE-2024-341615.3When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Uni CVE-2024-341625.3The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authe CVE-2024-341638.2Improper input validation in firmware for some Intel(R) NUC may allow a privileged user to potentially enableescalation of privilege via loc CVE-2024-341646.7Uncontrolled search path element in some Intel(R) MAS software before version 2.5 may allow an authenticated user to potentially enable esca