CVE-2022-36899

2022-07-2715:15:09

[email protected]

web.nvd.nist.gov

jenkins

compuware

ispw

operations plugin

execution control

vulnerability

java system properties

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

EPSS

0.001

Percentile

35.2%

JSON

Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.

Affected configurations

Nvd

Node

jenkinscompuware_ispw_operationsRange<1.0.9jenkins

AND

jenkinsjenkinsRange≤2.303.2lts

jenkinsjenkinsRange≤2.318-

VendorProductVersionCPE
jenkinscompuware_ispw_operations*cpe:2.3:a:jenkins:compuware_ispw_operations:*:*:*:*:*:jenkins:*:*
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*

Vendor	Product	Version	CPE
jenkins	compuware_ispw_operations	*	cpe:2.3:a:jenkins:compuware_ispw_operations::::::jenkins::*
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins:::::lts:::*
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins:::::-:::*