CVE-2022-36895: 
Java vulnerability analysis and mitigation

CVE-2022-36895 is a security vulnerability discovered in Jenkins Compuware Topaz Utilities Plugin versions 1.0.8 and earlier. The vulnerability was disclosed on July 27, 2022, and affects the permission checking mechanism in several HTTP endpoints of the plugin (Jenkins Advisory).

The vulnerability stems from missing permission checks in several HTTP endpoints within the Compuware Topaz Utilities Plugin. The severity is rated as Medium according to the CVSS scoring system. The vulnerability specifically affects the plugin's permission validation mechanisms when handling HTTP endpoint requests (Jenkins Advisory).

The vulnerability allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs stored in Jenkins. These enumerated credentials IDs could potentially be exploited as part of a broader attack to capture the credentials using another vulnerability (Jenkins Advisory).

The vulnerability has been fixed in Compuware Topaz Utilities Plugin version 1.0.9. The updated version implements appropriate permission checks for enumerating hosts and ports of Compuware configurations and credentials IDs. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).