Description
Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.
Remediation
References
http://www.openwall.com/lists/oss-security/2022/10/19/3
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2627
Related Vulnerabilities
CVE-2021-42392 Vulnerability in maven package com.h2database:h2
CVE-2019-17570 Vulnerability in maven package org.apache.xmlrpc:xmlrpc
CVE-2019-9154 Vulnerability in maven package org.webjars.npm:openpgp
CVE-2019-10747 Vulnerability in npm package set-value
CVE-2023-50776 Vulnerability in maven package com.cloudtp.jenkins:paaslane-estimate