PT-2022-4028 · Compuware+1 · Jenkins Compuware Zadviser Api Plugin+1

Published 2022-07-27 · Updated 2023-11-02 · CVE-2022-36900

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Compuware zAdviser API Plugin versions 1.0.3 and earlier

Description The issue is related to a flaw in the data protection mechanism of the Jenkins Compuware zAdviser API Plugin. This flaw can be exploited by a remote attacker to gain unauthorized access to protected system configuration information. The vulnerability allows attackers who can control agent processes to retrieve Java system properties by executing a controller/agent message that is not restricted to agents.

Recommendations For Jenkins Compuware zAdviser API Plugin versions 1.0.3 and earlier, update to version 1.0.4 or later to restrict the execution of the controller/agent message and prevent unauthorized access to Java system properties.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2022-04861

CVE-2022-36900

GHSA-5XP2-7QFC-FWGC

Affected Products

Jenkins

Jenkins Compuware Zadviser Api Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-36900 · Security Note
• https://osv.dev/vulnerability/GHSA-5xp2-7qfc-fwgc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36900 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-2630 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04861 · Security Note
• https://github.com/jenkinsci/compuware-zadviser-api-plugin/commit/0aff2c33476b55b30e1fa9bb0eacf2f9f70ed0a8 · Note
• http://openwall.com/lists/oss-security/2022/07/27/1 · Note