CVE-2022-43422
First published: Wed Oct 19 2022(Updated: )
Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed. It allows attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process. This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3). Compuware Topaz Utilities Plugin 1.0.9 restricts execution of the agent/controller message to agents.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Compuware Topaz Utilities | <1.0.9 | |
| Jenkins Jenkins | <=2.138 | |
| Jenkins Jenkins | <=2.303.2 | |
| All of | ||
| <1.0.9 | ||
| Any of | ||
| <=2.138 | ||
| <=2.303.2 | ||
| maven/com.compuware.jenkins:compuware-topaz-utilities | <1.0.9 | 1.0.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-43422
- https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2620
- http://www.openwall.com/lists/oss-security/2022/10/19/3
- https://github.com/jenkinsci/compuware-topaz-utilities-plugin/commit/a91bae5fcfb17d2d0af0c86c2870f10b2bb9c20a
- https://github.com/advisories/GHSA-2x49-wj38-78q9 (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-43422.
What is the severity of CVE-2022-43422?
The severity of CVE-2022-43422 is medium with a CVSS score of 5.3.
What is the affected software for CVE-2022-43422?
The affected software for CVE-2022-43422 is Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier.
How can attackers exploit CVE-2022-43422?
Attackers with control over agent processes can exploit CVE-2022-43422 to obtain the values of Java system properties from the Jenkins controller process.
Are the Jenkins Jenkins versions vulnerable to CVE-2022-43422?
No, the Jenkins Jenkins versions 2.138 and 2.303.2 LTS are not vulnerable to CVE-2022-43422.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/github-advisory
- source/GitHub
- alias/GHSA-2x49-wj38-78q9
- alias/CVE-2022-43422
- agent/software-canonical-lookup
- collector/github-advisory-latest
- collector/nvd-api
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- package-manager/maven
- vendor/jenkins
- canonical/jenkins compuware topaz utilities
- canonical/jenkins jenkins
- version/jenkins jenkins/2.138
- version/jenkins jenkins/2.303.2