CVE-2022-41228 - A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials

Back Back to CVE browser

HIGH

A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials

Published Sep 21, 2022

8.8

HIGH

CVSS 3.1

EPSS 0.97%

Description

A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials.

Affected products

Vendor Jenkins project Product Jenkins NS-ND Integration Performance Publisher Plugin Default
unknown
Affected
- ≥ unspecified, ≤ 4.8.0.129

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins NS-ND Integration Performance Publisher Plugin	unknown	Affected ≥ unspecified, ≤ 4.8.0.129

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6845
Advisory
https://github.com/advisories/GHSA-j2mj-g8jp-gjfm
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41228
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2737
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6845		Advisory
https://github.com/advisories/GHSA-j2mj-g8jp-gjfm		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41228
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2737		x_refsource_CONFIRMVendor Advisory