GitHub Advisoryadvisory · Maven

GHSA-5xp2-7qfc-fwgc Jenkins Compuware zAdviser API Plugin vulnerable to protection mechanism failure

MEDIUM Published 2022-07-28 Modified 2023-10-27 Official page ↗
Aliases
CVE-2022-36900
Ecosystem
Maven
Packages
com.compuware.jenkins:compuware-zadviser-api
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-693
Reviewed
2022-08-10

Affected packages

• Maven com.compuware.jenkins:compuware-zadviser-api: < 1.0.4 → fixed in 1.0.4

Description

Jenkins Compuware zAdviser API Plugin defines a controller/agent message that retrieves Java system properties. Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of the controller/agent message to agents. This allows attackers able to control agent processes to retrieve Java system properties. Compuware zAdviser API Plugin 1.0.4 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.

Related

Alias · CVE (1)

  • CVE-2022-36900 Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing… vulnerability

Weakness · CWE (1)

  • CWE-693 Protection Mechanism Failure weakness

References