CVE-2022-43424

MEDIUM

Jenkins Compuware Xpediter Code Coverage Plugin <1.0.7 - Info Discl...

Title source: llm

Description

Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

References (2)

Core 2

Core References

Vendor Advisory

https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2627

Mailing List, Third Party Advisory mailing-list

http://www.openwall.com/lists/oss-security/2022/10/19/3

Scores

CVSS v3 5.3

EPSS 0.0137

EPSS Percentile 80.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-693

Status published

Products (2)

com.compuware.jenkins/compuware-xpediter-code-coverage 0 - 1.0.8Maven

jenkins/compuware_xpediter_code_coverage < 1.0.8

Published Oct 19, 2022

Tracked Since Feb 18, 2026