PT-2022-26907 · Jenkins · Jenkins Compuware Source Code Download For Endevor+1

Published 2022-10-19 · Updated 2025-05-08 · CVE-2022-43423

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin versions 2.0.12 and earlier Jenkins versions 2.318 and earlier, LTS versions 2.303.2 and earlier

Description The issue allows attackers who can control agent processes to obtain Java system properties from the Jenkins controller process due to an agent/controller message that does not limit its execution location. This can be exploited by controlling agent processes, potentially leading to unauthorized access to sensitive information.

Recommendations For Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin versions 2.0.12 and earlier, update to version 2.0.13 or later, which restricts the execution of the agent/controller message to agents. For Jenkins versions 2.318 and earlier, LTS versions 2.303.2 and earlier, upgrade to a newer version to mitigate the risk.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

CWE-610

Related Identifiers

CVE-2022-43423

GHSA-682J-2P53-XP5F

Affected Products

Jenkins

Jenkins Compuware Source Code Download For Endevor

References · 8

• https://osv.dev/vulnerability/CVE-2022-43423 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43423 · Security Note
• https://osv.dev/vulnerability/GHSA-682j-2p53-xp5f · Vendor Advisory
• https://github.com/jenkinsci/compuware-scm-downloader-plugin · Note
• https://github.com/jenkinsci/compuware-scm-downloader-plugin/commit/115f057078baad506e2b34b74f4f0600f81990b3 · Note
• http://openwall.com/lists/oss-security/2022/10/19/3 · Note
• https://t.me/cvenotify/121437 · Telegram Post