CVE-2022-43423 Agent-to-controller security bypass vulnerability in Jenkins BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin
Attackers controlling agent processes can read Java system properties from the Jenkins controller due to unrestricted message execution in the Compuware plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-43423?
CVE-2022-43423 is a medium-severity vulnerability in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin, published on 19 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.
Weakness: CWE-610
Which versions are affected by CVE-2022-43423?
2 open source packages ship an affected version, including com.compuware.jenkins:compuware-scm-downloader. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.compuware.jenkins:compuware-scm-downloader Maven | All versions | 2.0.13 |
com.compuware.jenkins:compuware-scm-downloader Maven | All versions | 2.0.13 |
Products include Jenkins Compuware Source Code Download for Endevor\, Pds\, and Ispw.
How do I fix CVE-2022-43423?
Upgrade com.compuware.jenkins:compuware-scm-downloader to 2.0.13 or later.
Is CVE-2022-43423 being exploited?
There is no known exploitation of CVE-2022-43423 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin
Sources
Also known as GHSA-682j-2p53-xp5f.