Login Request a demo
High severity · published Oct 19, 2022
CVE-2022-43429
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to…
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JC
Jenkins Compuware Topaz for Total Test Plugin · Jenkins project
through 2.4.8 · source: vendor
CT
Compuware Topaz For Total Test · Jenkins
through 2.4.8 · source: NVD
Affected product
JC
Jenkins Compuware Topaz for Total Test Plugin
Jenkins project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43429
Mailing List
http://www.openwall.com/lists/oss-security/2022/10/19/3
Vendor Advisory
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2624
More from Jenkins Compuware Topaz for Total Test Plugin
7.5
CVE-2022-43430
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks
5.3
CVE-2022-43428
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to…
4.3
CVE-2022-43427
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to…