cbcvebase.
CVE-2022-41229
published 2022-09-21

CVE-2022-41229: Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build…

PriorityP423medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.47%
37.4th percentile
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected

23 ranges
VendorProductVersion rangeFixed in
jenkinsanchore_container_image_scanner_plugin——
jenkinsapprenda_plugin——
jenkinsbigpanda_notifier_plugin——
jenkinsbmc_ami_common_configuration_plugin——
jenkinscons3rt_plugin——
jenkinsdotci_plugin——
jenkinsjenkins_core——
jenkinsjenkins_weekly——
jenkinslack_of_authentication_mechanism_in_dotci_plugin——
jenkinsns-nd_integration_performance_publisher<= 4.8.0.134—
jenkinsns-nd_integration_performance_publisher_plugin——
jenkinsrqm_plugin——
jenkinsrundeck_plugin——
jenkinsscm_httpclient_plugin——
jenkinssecurity_inspector_plugin——
jenkinssmalltest_plugin——
jenkinsthis_could_create_confusion_in_users_of_the_plugin——
jenkinsurls_of_jenkins_servers_that_the_plugin——
jenkinsview26_test-reporting_plugin——
jenkinswalti_plugin——
jenkinswildfly_deployer_plugin——
jenkinsworksoft_execution_manager_plugin——
jenkins_projectjenkins_ns-nd_integration_performance_publisher_pluginunspecified – 4.8.0.134—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.