cbcvebase.
CVE-2022-45391
published 2022-11-15

CVE-2022-45391: Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation…

PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.44%
37.7th percentile
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM.

Affected

22 ranges
VendorProductVersion rangeFixed in
jenkinsassociated_files_plugin——
jenkinsbart_plugin——
jenkinscccc_plugin——
jenkinscluster_statistics_plugin——
jenkinsconfig_rotator_plugin——
jenkinsdelete_log_plugin——
jenkinsjapex_plugin——
jenkinsjunit_plugin——
jenkinsnaginator_plugin——
jenkinsns-nd_integration_performance_publisher< 4.8.0.1464.8.0.146
jenkinsns-nd_integration_performance_publisher_plugin——
jenkinspipeline_utility_steps_plugin——
jenkinsregistry_notification_plugin——
jenkinsreverse_proxy_auth_plugin——
jenkinsscript_security_plugin——
jenkinssourcemonitor_plugin——
jenkinssupport_core_plugin——
jenkinsurls_in_the_plugin——
jenkinsviolations_plugin——
jenkinsxml_linter_plugin——
jenkinsxp-dev_plugin——
jenkins_projectjenkins_ns-nd_integration_performance_publisher_pluginunspecified – 4.8.0.143—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.