Jenkins Compuware Topaz for Total Test Plugin vulnerable to Protection Mechanism Failure

2022-10-1919:00:22

Google

osv.dev

jenkins

compuware

total test

plugin

vulnerable

protection mechanism failure

agent

controller

arbitrary files

jenkins controller file system

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

52.5%

JSON

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.

CPENameOperatorVersion
com.compuware.jenkins:compuware-topaz-for-total-testeq2.0
com.compuware.jenkins:compuware-topaz-for-total-testeq2.4.3
com.compuware.jenkins:compuware-topaz-for-total-testeq2.3.2
com.compuware.jenkins:compuware-topaz-for-total-testeq2.2.0
com.compuware.jenkins:compuware-topaz-for-total-testeq2.0.2
com.compuware.jenkins:compuware-topaz-for-total-testeq2.1.0
com.compuware.jenkins:compuware-topaz-for-total-testeq2.3.0
com.compuware.jenkins:compuware-topaz-for-total-testeq2.4.5
com.compuware.jenkins:compuware-topaz-for-total-testeq2.4.4
com.compuware.jenkins:compuware-topaz-for-total-testeq2.4.1

Name	Operator	Version
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.0
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.4.3
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.3.2
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.2.0
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.0.2
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.1.0
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.3.0
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.4.5
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.4.4
com.compuware.jenkins:compuware-topaz-for-total-test	eq	2.4.1