Jenkins Compuware zAdviser API Plugin vulnerable to protection mechanism failure

高 8.2CVE-2022-36900 · GHSA-5xp2-7qfc-fwgc · 27/07/2022 公開 · 17/06/2026 更新

要点

CVE-2022-36900 は com.compuware.jenkins:compuware-zadviser-api, compuware zadviser api (jenkins) に影響する深刻度「高」 (CVSS 8.2) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 65.0% より高い）。
対処：1.0.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
com.compuware.jenkins:compuware-zadviser-api Maven	`< 1.0.4`	`1.0.4`
compuware zadviser api jenkins	`≤ 1.0.3`	修正版なし

概要

Jenkins Compuware zAdviser API Plugin defines a controller/agent message that retrieves Java system properties.

Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of the controller/agent message to agents. This allows attackers able to control agent processes to retrieve Java system properties.

Compuware zAdviser API Plugin 1.0.4 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.

NVD の説明

Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.