CVE-2022-36900: 
Java vulnerability analysis and mitigation

CVE-2022-36900 affects the Compuware zAdviser API Plugin versions 1.0.3 and earlier for Jenkins. The vulnerability was disclosed on July 27, 2022, and impacts Jenkins installations running version 2.318 and earlier, or LTS 2.303.2 and earlier (Jenkins Advisory, OSS Security).

The vulnerability stems from the plugin's implementation of a controller/agent message that retrieves Java system properties. The core issue is that the plugin does not properly restrict the execution of this controller/agent message to agents, creating a security bypass vulnerability. The severity is rated as Medium according to CVSS scoring (Jenkins Advisory).

When exploited, this vulnerability allows attackers who have control over agent processes to retrieve Java system properties from the Jenkins controller. This could potentially expose sensitive system information to unauthorized users (Jenkins Advisory).

The vulnerability has been fixed in Compuware zAdviser API Plugin version 1.0.4, which prevents the affected controller/agent message from being submitted by agents for execution on the controller. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).