Jenkins NS-ND Integration Performance Publisher Plugin disables SSL/TLS certificate validation globally and unconditionally

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-45391 · ADVISORY
• jenkinsci/cavisson-ns-nd-integration-plugin · PACKAGE
• jenkins.io/security/advisory/2022-11-15 · WEB
• jenkins.io/security/advisory/2022-11-15 · WEB
• openwall.com/lists/oss-security/2022/11/15/4 · WEB

io.jenkins.plugins:cavisson-ns-nd-integration のその他の脆弱性

• CVE-2023-33000高 7.5Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, …
• CVE-2022-45392中 6.5Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jen…
• CVE-2022-41229中 5.4Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/N…
• CVE-2022-41228高 8.8A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Rea…
• CVE-2022-41227高 8.8A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows att…