Jenkins Compuware Strobe Measurement Plugin Missing Authorization vulnerability

MOYENNE 4.3CVE-2022-43431 · GHSA-hcw3-6459-pwhc · Published 19/10/2022 · updated 17/06/2026

En bref

CVE-2022-43431 est une vulnérabilité MOYENNE (CVSS 4.3) touchant com.compuware.jenkins:compuware-strobe-measurement, compuware strobe measurement (jenkins).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.55%, plus élevée que 46.2% des vulnérabilités.
Correctif : mettre à jour vers 1.0.2 ou plus récent.

Package	Affected versions	Patched versions
com.compuware.jenkins:compuware-strobe-measurement Maven	`< 1.0.2`	`1.0.2`
compuware strobe measurement jenkins	`≤ 1.0.1`	No fix yet

Description

Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-43431 · ADVISORY
jenkinsci/compuware-strobe-measurement-plugin commit 29a0d38 · WEB
jenkins.io/security/advisory/2022-10-19 · WEB
openwall.com/lists/oss-security/2022/10/19/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free