Description

Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

Remediation

References

https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2620

http://www.openwall.com/lists/oss-security/2022/10/19/3

Related Vulnerabilities

CVE-2023-24430 Vulnerability in maven package org.jenkins-ci.plugins:semantic-versioning-plugin

CVE-2019-11269 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth2

CVE-2012-2378 Vulnerability in maven package org.apache.cxf:cxf-bundle-minimal

CVE-2022-35915 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts

CVE-2021-44145 Vulnerability in maven package org.apache.nifi:nifi

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory Mailing List Third Party Advisory NVD-CWE-noinfo