Jenkins Compuware Strobe Measurement Plugin Missing Authorization vulnerability

MITTEL 4.3CVE-2022-43431 · GHSA-hcw3-6459-pwhc · Published 19/10/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-43431 ist eine Schwachstelle (MITTEL (CVSS 4.3)) in com.compuware.jenkins:compuware-strobe-measurement, compuware strobe measurement (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.55%, höher als bei 46.2% aller Schwachstellen.
Abhilfe: auf 1.0.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
com.compuware.jenkins:compuware-strobe-measurement Maven	`< 1.0.2`	`1.0.2`
compuware strobe measurement jenkins	`≤ 1.0.1`	No fix yet

Description

Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-43431 · ADVISORY
jenkinsci/compuware-strobe-measurement-plugin commit 29a0d38 · WEB
jenkins.io/security/advisory/2022-10-19 · WEB
openwall.com/lists/oss-security/2022/10/19/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free