CVE-2022-43428

EPSS 0.75%
Published 19.10.2022 16:15:11
Last modified 08.05.2025 19:15:55
Source jenkinsci-cert@googlegroups.co
Teams watchlist Login
Open Login

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Compuware Topaz For Total Test SwPlatformjenkins Version <= 2.4.8

Jenkins ≫ Jenkins SwEditionlts Version <= 2.303.2
Jenkins ≫ Jenkins SwEdition- Version <= 2.318

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.75%	0.724

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-610 Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

http://www.openwall.com/lists/oss-security/2022/10/19/3

Third Party Advisory

Mailing List

https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2624

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-43428

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-43428

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-43428

EUVD