PT-2022-4018 · Compuware+1 · Jenkins Compuware Ispw Operations Plugin+1

Published 2022-07-27 · Updated 2023-11-02 · CVE-2022-36899

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Compuware ISPW Operations Plugin versions 1.0.8 and earlier

Description The issue is related to the Jenkins Compuware ISPW Operations Plugin, which does not restrict the execution of a controller/agent message to agents. This allows attackers who can control agent processes to retrieve Java system properties. The vulnerability can be exploited by attackers to gain unauthorized access to system configuration information.

Recommendations For Jenkins Compuware ISPW Operations Plugin versions 1.0.8 and earlier, update to version 1.0.9 or later, which does not allow the affected controller/agent message to be submitted by agents for execution on the controller. As a temporary workaround, consider restricting access to the controller/agent message to prevent exploitation.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2022-04851

CVE-2022-36899

GHSA-57F2-52WJ-7VJ6

Affected Products

Jenkins

Jenkins Compuware Ispw Operations Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-36899 · Security Note
• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-2629 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-57f2-52wj-7vj6 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04851 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36899 · Vendor Advisory
• https://github.com/jenkinsci/compuware-ispw-operations-plugin · Note
• https://t.me/cvenotify/33851 · Telegram Post
• https://t.me/cibsecurity/47112 · Telegram Post
• http://openwall.com/lists/oss-security/2022/07/27/1 · Note