CVE-2022-43428
First published: Wed Oct 19 2022(Updated: )
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process. These vulnerabilities are only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3).
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/com.compuware.jenkins:compuware-topaz-for-total-test | <=2.4.8 | 2.4.9 |
| Jenkins Compuware Topaz For Total Test | <=2.4.8 | |
| Jenkins Jenkins | <=2.303.2 | |
| Jenkins Jenkins | <=2.318 | |
| All of | ||
| Jenkins Compuware Topaz For Total Test | <=2.4.8 | |
| Any of | ||
| Jenkins Jenkins | <=2.303.2 | |
| Jenkins Jenkins | <=2.318 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-43428
- https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2624
- http://www.openwall.com/lists/oss-security/2022/10/19/3
- https://github.com/jenkinsci/compuware-topaz-for-total-test-plugin/commit/5fca6eb21599f8f27323dfa17a6e44f8176ca551
- https://github.com/advisories/GHSA-xp3r-9wx8-q2mm (Advisory)
Frequently Asked Questions
What is CVE-2022-43428?
CVE-2022-43428 is a vulnerability in Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier that allows attackers to obtain the values of Java system properties from the Jenkins controller process.
What software versions are affected by CVE-2022-43428?
Jenkins Compuware Topaz for Total Test Plugin version 2.4.8 and earlier are affected by CVE-2022-43428.
What is the severity of CVE-2022-43428?
CVE-2022-43428 has a severity rating of 5.3, which is considered medium.
How can an attacker exploit CVE-2022-43428?
An attacker who can control agent processes can exploit CVE-2022-43428 to obtain the values of Java system properties from the Jenkins controller process.
Is Jenkins Jenkins version 2.303.2 vulnerable to CVE-2022-43428?
No, Jenkins Jenkins version 2.303.2 is not vulnerable to CVE-2022-43428.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/github-advisory
- source/GitHub
- alias/GHSA-xp3r-9wx8-q2mm
- alias/CVE-2022-43428
- agent/software-canonical-lookup
- collector/github-advisory-latest
- collector/nvd-api
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- package-manager/maven
- vendor/jenkins
- canonical/jenkins compuware topaz for total test
- version/jenkins compuware topaz for total test/2.4.8
- canonical/jenkins jenkins
- version/jenkins jenkins/2.303.2
- version/jenkins jenkins/2.318