Medium severity · published Oct 19, 2022
CVE-2022-43423
Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it can be executed,…
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JC
Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin · Jenkins project
through 2.0.12 · source: vendor
CS
Compuware Source Code Download For Endevor, Pds, And Ispw · Jenkins
before 2.0.13 · source: NVD
Affected product
JC
Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin
Jenkins project