Read the docs
TI-2022-22358 Aliases CVE-2022-45392GHSA-x2w2-5552-fjv6

Insufficiently protected credentials in Jenkins NS-ND Integration Performance Publisher…

Priority LOW 30CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00717 54th percentileScored 2026-11-07
Fix Fixed io.jenkins.plugins:cavisson-ns-nd-integration (Maven): 4.8.0.146

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins NS-ND Integration Performance Publisher Pluginup to 4.8.0.143—No fix listedCNA
—io.jenkins.plugins:cavisson-ns-nd-integration (Maven)before 4.8.0.1464.8.0.146Patch availableGHSA-x2w2-5552-fjv6
  • Jenkins NS-ND Integration Performance Publisher Plugin VendorJenkins Affected up to 4.8.0.143 Fixed in — No fix listed CNA
  • io.jenkins.plugins:cavisson-ns-nd-integration (Maven) Vendor— Affected before 4.8.0.146 Fixed in 4.8.0.146 Patch available GHSA-x2w2-5552-fjv6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:ns-nd_integration_performance_publisher:*:*:*:*:*:jenkins:*:*before 4.8.0.146VulnerableJenkins
  • cpe:2.3:a:jenkins:ns-nd_integration_performance_publisher:*:*:*:*:*:jenkins:*:* Versions before 4.8.0.146 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-x2w2-5552-fjv6 io.jenkins.plugins:cavisson-ns-nd-integration (Maven) Fixed in 4.8.0.146 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-45392
  2. 2026-10-03 Alias added: GHSA-x2w2-5552-fjv6

References

Advisory 3

Other 1

  • TI-2022-19738 Missing authorization in Jenkins NS-ND Integration Performance Publisher Plugin CVSS 3.1HIGH 8.8
  • TI-2022-19737 Cross-site request forgery in Jenkins NS-ND Integration Performance Publisher Plugin CVSS 3.1HIGH 8.8
  • TI-2023-16188 Insufficiently protected credentials in Jenkins NS-ND Integration Performance Publisher… CVSS 3.1HIGH 7.5
  • TI-2022-22357 Improper certificate validation in Jenkins NS-ND Integration Performance Publisher Plugin CVSS 3.1HIGH 7.5
  • TI-2022-18199 Improper certificate validation in Jenkins NS-ND Integration Performance Publisher Plugin CVSS 3.1HIGH 7.5
  • TI-2022-19739 Cross-site scripting in Jenkins NS-ND Integration Performance Publisher Plugin CVSS 3.1MEDIUM 5.4
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences