Vulnerabilities > CVE-2022-36899 - Unspecified vulnerability in Jenkins Compuware Ispw Operations

CVSS 8.2 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

jenkins

NVD

Published: 2022-07-27

Updated: 2023-11-02

Summary

Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.

Vulnerable Configurations

Part	Description	Count
Application	Jenkins Jenkins Compuware Ispw Operations - Jenkins Compuware Ispw Operations 1.0.2 Jenkins Compuware Ispw Operations 1.0.3 Jenkins Compuware Ispw Operations 1.0.4 Jenkins Compuware Ispw Operations 1.0.5 Jenkins Compuware Ispw Operations 1.0.6 Jenkins Compuware Ispw Operations 1.0.7 Jenkins Compuware Ispw Operations 1.0.8 Jenkins Jenkins *	10

References

https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2629
http://www.openwall.com/lists/oss-security/2022/07/27/1