Lucene search

GitHub Advisory DatabaseGHSA-J2MJ-G8JP-GJFM

HistorySep 22, 2022 - 12:00 a.m.

Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Missing Authorization

2022-09-2200:00:28

CWE-862

GitHub Advisory Database

github.com

jenkins

ns-nd integration

performance publisher plugin

missing authorization

vulnerability

webserver

credentials

overall/read

overall/administer

version 4.8.0.130

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

42.8%

JSON

A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials. Version 4.8.0.130 requires POST requests and Overall/Administer permission for the affected form validation method.

Affected configurations

Vulners

Node

io.jenkins.pluginscavisson-ns-nd-integrationRange≤4.8.0.129

VendorProductVersionCPE
io.jenkins.pluginscavisson-ns-nd-integration*cpe:2.3:a:io.jenkins.plugins:cavisson-ns-nd-integration:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
io.jenkins.plugins	cavisson-ns-nd-integration	*	cpe:2.3:a:io.jenkins.plugins:cavisson-ns-nd-integration::::::::

References

github.com/advisories/GHSA-j2mj-g8jp-gjfm

nvd.nist.gov/vuln/detail/CVE-2022-41228

www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2737

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

42.8%

JSON

Related for GHSA-J2MJ-G8JP-GJFM