GitHub Advisoryadvisory · Maven

GHSA-x5gv-5rqv-654m Jenkins Compuware Topaz for Total Test Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins

MEDIUM Published 2022-10-19 Modified 2022-10-25 Official page ↗
Aliases
CVE-2022-43427
Ecosystem
Maven
Packages
com.compuware.jenkins:compuware-topaz-for-total-test
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2022-10-19

Affected packages

• Maven com.compuware.jenkins:compuware-topaz-for-total-test: < 2.4.9 → fixed in 2.4.9

Description

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Related

Alias · CVE (1)

  • CVE-2022-43427 Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References