GHSA-7fvj-g3wp-29g8

ghsaUSosv

Jenkins Compuware Topaz for Total Test Plugin vulnerable to Protection Mechanism Failure

view advisory published 2022-10-19Licence: CC-BY-4.0

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-43429US	high7.5	0.74% (54th)	—	2022-10-19
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to cont…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2022/10/19/3WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-43429ADVISORY
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2624WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan