Description

Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/10/19/3

https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2627

Related Vulnerabilities

CVE-2019-17554 Vulnerability in maven package org.apache.olingo:odata-server-api

CVE-2019-16558 Vulnerability in maven package com.inflectra.spiratest.plugins:inflectra-spira-integration

CVE-2023-26111 Vulnerability in npm package @nubosoftware/node-static

CVE-2020-13697 Vulnerability in maven package org.nanohttpd:nanohttpd-nanolets

CVE-2022-36918 Vulnerability in maven package org.jenkins-ci.plugins:buckminster

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory NVD-CWE-noinfo