CVE-2022-43422 Agent-to-controller security bypass vulnerability in Jenkins Compuware Topaz Utilities Plugin
Attackers controlling agent processes can read Java system properties from the Jenkins controller via an unrestricted message handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-43422?
CVE-2022-43422 is a medium-severity vulnerability in Jenkins Compuware Topaz Utilities Plugin, published on 19 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.
Weakness: CWE-693
Which versions are affected by CVE-2022-43422?
2 open source packages ship an affected version, including com.compuware.jenkins:compuware-topaz-utilities. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.compuware.jenkins:compuware-topaz-utilities Maven | All versions | 1.0.9 |
com.compuware.jenkins:compuware-topaz-utilities Maven | All versions | 1.0.9 |
Products include Jenkins Compuware Topaz Utilities.
How do I fix CVE-2022-43422?
Upgrade com.compuware.jenkins:compuware-topaz-utilities to 1.0.9 or later.
Is CVE-2022-43422 being exploited?
There is no known exploitation of CVE-2022-43422 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Compuware Topaz Utilities Plugin
Sources
Also known as GHSA-2x49-wj38-78q9.