CVE-2022-43429 Jenkins Compuware Topaz for Total Test Plugin vulnerable to Protection Mechanism Failure

What is CVE-2022-43429?

CVE-2022-43429 is a high-severity path traversal vulnerability in Jenkins Compuware Topaz for Total Test Plugin, published on 19 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.

Weakness: CWE-284

Which versions are affected by CVE-2022-43429?

2 open source packages ship an affected version, including com.compuware.jenkins:compuware-topaz-for-total-test. It affects 1 product.

Products include Jenkins Compuware Topaz for Total Test.

How do I fix CVE-2022-43429?

No fix has been published for CVE-2022-43429 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-43429 being exploited?

There is no known exploitation of CVE-2022-43429 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Compuware Topaz for Total Test Plugin

• CVE-2022-43430 XXE vulnerability in Jenkins Compuware Topaz for Total Test Plugin High 7.5
• CVE-2022-43428 Agent-to-controller security bypass vulnerabilities in Jenkins Compuware Topaz for Total Test Plugin Medium 5.3
• CVE-2022-43427 Jenkins Compuware Topaz for Total Test Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7fvj-g3wp-29g8.