Medium severity · published Oct 19, 2022
CVE-2022-43422
Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control…
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JC
Jenkins Compuware Topaz Utilities Plugin · Jenkins project
through 1.0.8 · source: vendor
CT
Compuware Topaz Utilities · Jenkins
before 1.0.9 · source: NVD
Affected product
JC
Jenkins Compuware Topaz Utilities Plugin
Jenkins project