TI-2022-17115 Aliases CVE-2022-36900 GHSA-5xp2-7qfc-fwgc

Protection mechanism failure in Jenkins Compuware zAdviser API Plugin

LOW 38CWE-693Published 2022-07-27 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-693.

Summary

Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.

Why it matters now

EPSS 0.01071 65th percentileScored 2026-11-07

Fix Fixed com.compuware.jenkins:compuware-zadviser-api (Maven): 1.0.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Compuware zAdviser API Plugin	up to 1.0.3	—	No fix listed	CNA
—	com.compuware.jenkins:compuware-zadviser-api (Maven)	before 1.0.4	1.0.4	Patch available	GHSA-5xp2-7qfc-fwgc

Jenkins Compuware zAdviser API Plugin VendorJenkins Affected up to 1.0.3 Fixed in — No fix listed CNA
com.compuware.jenkins:compuware-zadviser-api (Maven) Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available GHSA-5xp2-7qfc-fwgc

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:compuware_zadviser_api::::::jenkins::*	up to 1.0.3	Vulnerable	Jenkins
cpe:2.3:a:jenkins:jenkins:::::lts:::*	up to 2.303.2	Running on	Jenkins
cpe:2.3:a:jenkins:jenkins:::::-:::*	up to 2.318	Running on	Jenkins

cpe:2.3:a:jenkins:compuware_zadviser_api:*:*:*:*:*:jenkins:*:* Versions up to 1.0.3 Vulnerable ·Jenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions up to 2.303.2 Running on ·Jenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* Versions up to 2.318 Running on ·Jenkins

Remediation

Fix · GHSA-5xp2-7qfc-fwgc com.compuware.jenkins:compuware-zadviser-api (Maven) Fixed in 1.0.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-36900
2026-10-03 Alias added: GHSA-5xp2-7qfc-fwgc

References

Advisory 3

Other 1

https://github.com/jenkinsci/compuware-zadviser-api-plugin/commit/0aff2c33476b55b30e1fa9bb0eacf2f9f70ed0a8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences