Permission Check Bypass in Jenkins Compuware Topaz for Total Test Plugin
CVE-2022-43427

4.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Compuware Topaz For Total Test Plugin
Vendor
CVE Published:
19 October 2022

Summary

The Compuware Topaz for Total Test Plugin in Jenkins fails to enforce proper permission checks on several HTTP endpoints. This flaw permits attackers with Overall/Read permission to enumerate stored credential IDs within Jenkins, potentially exposing sensitive information. Administrators should apply the necessary updates to mitigate the risk and enhance security measures.

Affected Version(s)

Jenkins Compuware Topaz for Total Test Plugin <= 2.4.8

References

https://www.jenkins.io/security/advisory/2022-10-19/#SECU...
http://www.openwall.com/lists/oss-security/2022/10/19/3
mailing-list

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.