CVE-2022-43428 Agent-to-controller security bypass vulnerabilities in Jenkins Compuware Topaz for Total Test Plugin

Medium 5.3 Published 19 Oct 2022 Updated 8 May 2025

Attackers controlling agent processes can read Java system properties from the Jenkins controller via an unrestricted message handler in the Topaz for Total Test plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-43428?

CVE-2022-43428 is a medium-severity vulnerability in Jenkins Compuware Topaz for Total Test Plugin, published on 19 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

Weakness: CWE-610

Which versions are affected by CVE-2022-43428?

2 open source packages ship an affected version, including com.compuware.jenkins:compuware-topaz-for-total-test. It affects 1 product.

Package	Affected	Fixed in
`com.compuware.jenkins:compuware-topaz-for-total-test` Maven	All versions	`2.4.9`
`com.compuware.jenkins:compuware-topaz-for-total-test` Maven	All versions	`2.4.9`

Products include Jenkins Compuware Topaz for Total Test.

How do I fix CVE-2022-43428?

Upgrade com.compuware.jenkins:compuware-topaz-for-total-test to 2.4.9 or later.

Is CVE-2022-43428 being exploited?

There is no known exploitation of CVE-2022-43428 in the wild and no public exploit code.

Sources

Also known as GHSA-xp3r-9wx8-q2mm.