CVE-2022-45392

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.
Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:ns-nd_integration_performance_publisher:*:*:*:*:*:jenkins:*:*

History

01 Nov 2023, 20:00

Type Values Removed Values Added
References (MISC) http://www.openwall.com/lists/oss-security/2022/11/15/4 - (MISC) http://www.openwall.com/lists/oss-security/2022/11/15/4 - Mailing List, Third Party Advisory

25 Oct 2023, 18:17

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2022/11/15/4 -

07 Jul 2023, 19:06

Type Values Removed Values Added
CWE CWE-256 CWE-522

18 Nov 2022, 04:49

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.5
First Time Jenkins ns-nd Integration Performance Publisher
Jenkins
CPE cpe:2.3:a:jenkins:ns-nd_integration_performance_publisher:*:*:*:*:*:jenkins:*:*
References (CONFIRM) https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2912 - (CONFIRM) https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2912 - Vendor Advisory

15 Nov 2022, 20:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-11-15 20:15

Updated : 2023-12-10 14:35


NVD link : CVE-2022-45392

Mitre link : CVE-2022-45392

CVE.ORG link : CVE-2022-45392


JSON object : View

Products Affected

jenkins

  • ns-nd_integration_performance_publisher
CWE
CWE-522

Insufficiently Protected Credentials