Jenkins Ns-Nd Integration Performance Publisher vulnerabilities

8 CVEs affecting Jenkins Ns-Nd Integration Performance Publisher, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-33000, published 2023-05-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-41228, published 2022-09-21. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver…
CVE-2022-45392, published 2022-11-15. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with…
CVE-2022-34191, published 2022-06-23. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site…
CVE-2022-41229, published 2022-09-21. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step, resulting in a stored cross-site…
CVE-2023-33000, published 2023-05-16. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and…
CVE-2022-41227, published 2022-09-21. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect to an attacker-specified webserver using…
CVE-2022-45391, published 2022-11-15. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM.
CVE-2022-38666, published 2022-11-15. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features.