CVE-2022-36899 Agent-to-controller security bypass in Jenkins BMC Compuware ISPW Operations plugin
Attackers controlling agent processes can retrieve Java system properties due to missing restrictions on controller/agent message execution in the Jenkins Compuware ISPW Operations Plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36899?
CVE-2022-36899 is a high-severity vulnerability in Jenkins Compuware ISPW Operations Plugin, published on 27 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.
Which versions are affected by CVE-2022-36899?
2 open source packages ship an affected version, including com.compuware.jenkins:compuware-ispw-operations. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.compuware.jenkins:compuware-ispw-operations Maven | All versions | 1.0.9 |
com.compuware.jenkins:compuware-ispw-operations Maven | All versions | 1.0.9 |
Products include Jenkins Compuware Ispw Operations.
How do I fix CVE-2022-36899?
Upgrade com.compuware.jenkins:compuware-ispw-operations to 1.0.9 or later.
Is CVE-2022-36899 being exploited?
There is no known exploitation of CVE-2022-36899 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Compuware ISPW Operations Plugin
Sources
Also known as GHSA-57f2-52wj-7vj6.