Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

GHSA-mfcw-83qg-4vw3

GitHub Security Advisory

Agent-to-controller security bypass vulnerability in Jenkins Compuware Xpediter Code Coverage Plugin

✓ GitHub Reviewed MODERATE Has CVE
View on GitHub

Advisory Details

Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed.

It allows attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3).

Compuware Xpediter Code Coverage Plugin 1.0.8 restricts execution of the agent/controller message to agents.

Affected Packages

Maven com.compuware.jenkins:compuware-xpediter-code-coverage
Affected versions: 0 (fixed in 1.0.8)

Related CVEs

CVE-2022-43424

Key Information

GHSA ID
GHSA-mfcw-83qg-4vw3
Published
October 19, 2022 7:00 PM
Last Modified
December 16, 2022 7:50 PM
CVSS Score
5.0 /10
Primary Ecosystem
Maven
Primary Package
com.compuware.jenkins:compuware-xpediter-code-coverage
GitHub Reviewed
✓ Yes

Dataset

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.