Medium severity · published Oct 19, 2022
CVE-2022-43428
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to…
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JC
Jenkins Compuware Topaz for Total Test Plugin · Jenkins project
through 2.4.8 · source: vendor
CT
Compuware Topaz For Total Test · Jenkins
through 2.4.8 · source: NVD
Affected product
JC
Jenkins Compuware Topaz for Total Test Plugin
Jenkins project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43428
Mailing List
http://www.openwall.com/lists/oss-security/2022/10/19/3
Vendor Advisory
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2624
More from Jenkins Compuware Topaz for Total Test Plugin
7.5
CVE-2022-43429
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to…
7.5
CVE-2022-43430
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks
4.3
CVE-2022-43427
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to…