CVE-2022-43429

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Compuware Topaz for Total Test Plugin	>= unspecified, <= 2.4.8

References

http://www.openwall.com/lists/oss-security/2022/10/19/3Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2624Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/10/19/3Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2624Vendor Advisory

Timeline

Published: Oct 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-43434.3An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 1 CVE-2022-434307.5Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attac CVE-2022-434314.3Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers wi CVE-2022-434324.3Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content i CVE-2022-434334.3Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in wor CVE-2022-434345.3Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-genera CVE-2022-434355.3Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in wor CVE-2022-434368.8The File Upload function of EasyTest has insufficient filtering for special characters and file type. A remote attacker authenticated as a g CVE-2022-434378.8The Download function’s parameter of EasyTest has insufficient validation for user input. A remote attacker authenticated as a general user CVE-2022-434388.8The Administrator function of EasyTest has an Incorrect Authorization vulnerability. A remote attacker authenticated as a general user can e CVE-2022-434398.8A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0 CVE-2022-43444.3Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injecti