CVE-2022-43424 Agent-to-controller security bypass vulnerability in Jenkins Compuware Xpediter Code Coverage Plugin
Attackers controlling agent processes can read Java system properties from the Jenkins controller due to unrestricted message execution in the Compuware Xpediter plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-43424?
CVE-2022-43424 is a medium-severity vulnerability in Jenkins Compuware Xpediter Code Coverage Plugin, published on 19 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.
Weakness: CWE-693
Which versions are affected by CVE-2022-43424?
2 open source packages ship an affected version, including com.compuware.jenkins:compuware-xpediter-code-coverage. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.compuware.jenkins:compuware-xpediter-code-coverage Maven | All versions | 1.0.8 |
com.compuware.jenkins:compuware-xpediter-code-coverage Maven | All versions | 1.0.8 |
Products include Jenkins Compuware Xpediter Code Coverage.
How do I fix CVE-2022-43424?
Upgrade com.compuware.jenkins:compuware-xpediter-code-coverage to 1.0.8 or later.
Is CVE-2022-43424 being exploited?
There is no known exploitation of CVE-2022-43424 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Compuware Xpediter Code Coverage Plugin
Sources
Also known as GHSA-mfcw-83qg-4vw3.