CVE-2022-43427: Jenkins Compuware Topaz for Total Test Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins
4.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.22066%
CWE
Published
10/19/2022
Updated
1/5/2024
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.compuware.jenkins:compuware-topaz-for-total-test | maven | <= 2.4.8 | 2.4.9 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from missing permission checks in form validation methods handling credential/connection enumeration. The GitHub commit 0ba4274 adds authorization checks (checkPermission) to these specific methods, confirming they were previously vulnerable. These methods populate UI elements via HTTP endpoints, and without proper checks, allowed attackers with read access to enumerate sensitive IDs. The direct correlation between the CWE-862 description and the patched methods provides high confidence.