Jenkins Compuware Source Code Plugin Vulnerability Exposes Sensitive Java Properties
CVE-2022-43423

5.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Compuware Source Code Download For Endevor, Pds, And Ispw Plugin
Vendor
CVE Published:
19 October 2022

Summary

The Jenkins Compuware Source Code Download plugin prior to version 2.0.13 is susceptible to an improper access control vulnerability. This issue arises from an unrestricted execution of agent/controller messages. Consequently, attackers with control over agent processes might exploit this flaw to access sensitive Java system properties from the Jenkins controller process. This vulnerability could lead to exposure of critical configuration details, enhancing the risk of further attacks.

Affected Version(s)

Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin <= 2.0.12

References

https://www.jenkins.io/security/advisory/2022-10-19/#SECU...
http://www.openwall.com/lists/oss-security/2022/10/19/3
mailing-list

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.