CVE-2022-36899: Jenkins Compuware ISPW Operations Plugin before 1.0.9 vulnerable to protection mechanism failure

July 28, 2022 (updated August 10, 2022)

Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.

References

www.openwall.com/lists/oss-security/2022/07/27/1
github.com/advisories/GHSA-57f2-52wj-7vj6
nvd.nist.gov/vuln/detail/CVE-2022-36899
www.jenkins.io/security/advisory/2022-07-27/

Code Behaviors & Features

Detect and mitigate CVE-2022-36899 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →