CVE-2022-43422

Name of the Vulnerable Software and Affected Versions Jenkins Compuware Topaz Utilities Plugin versions 1.0.8 and earlier

Description The issue allows attackers who can control agent processes to obtain the values of Java system properties from the Jenkins controller process due to an agent/controller message that does not limit where it can be executed. This can be exploited in Jenkins versions 2.318 and earlier, and LTS versions 2.303.2 and earlier.

Recommendations For Jenkins Compuware Topaz Utilities Plugin versions 1.0.8 and earlier, update to version 1.0.9 or later, which restricts execution of the agent/controller message to agents. For Jenkins versions 2.318 and earlier, and LTS versions 2.303.2 and earlier, consider upgrading to a newer version to mitigate the risk of exploitation.