Medium severity · published Oct 19, 2022
CVE-2022-43424
Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to…
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JC
Jenkins Compuware Xpediter Code Coverage Plugin · Jenkins project
through 1.0.7 · source: vendor
CX
Compuware Xpediter Code Coverage · Jenkins
before 1.0.8 · source: NVD
Affected product
JC
Jenkins Compuware Xpediter Code Coverage Plugin
Jenkins project