Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

GHSA-2x49-wj38-78q9

GitHub Security Advisory

Agent-to-controller security bypass vulnerability in Jenkins Compuware Topaz Utilities Plugin

✓ GitHub Reviewed MODERATE Has CVE
View on GitHub

Advisory Details

Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed.

It allows attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3).

Compuware Topaz Utilities Plugin 1.0.9 restricts execution of the agent/controller message to agents.

Affected Packages

Maven com.compuware.jenkins:compuware-topaz-utilities
Affected versions: 0 (fixed in 1.0.9)

Related CVEs

CVE-2022-43422

Key Information

GHSA ID
GHSA-2x49-wj38-78q9
Published
October 19, 2022 7:00 PM
Last Modified
December 16, 2022 7:47 PM
CVSS Score
5.0 /10
Primary Ecosystem
Maven
Primary Package
com.compuware.jenkins:compuware-topaz-utilities
GitHub Reviewed
✓ Yes

Dataset

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.