Read the docs
TI-2023-16188 Aliases CVE-2023-33000GHSA-gqxr-hvrw-6hfh

Insufficiently protected credentials in Jenkins NS-ND Integration Performance Publisher…

Priority MEDIUM 40CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00569 47th percentileScored 2026-11-07
Fix Fixed io.jenkins.plugins:cavisson-ns-nd-integration (Maven): 4.11.0.48

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins NS-ND Integration Performance Publisher Pluginup to 4.8.0.149—No fix listedCNA
—io.jenkins.plugins:cavisson-ns-nd-integration (Maven)before 4.11.0.484.11.0.48Patch availableGHSA-gqxr-hvrw-6hfh
  • Jenkins NS-ND Integration Performance Publisher Plugin VendorJenkins Affected up to 4.8.0.149 Fixed in — No fix listed CNA
  • io.jenkins.plugins:cavisson-ns-nd-integration (Maven) Vendor— Affected before 4.11.0.48 Fixed in 4.11.0.48 Patch available GHSA-gqxr-hvrw-6hfh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:ns-nd_integration_performance_publisher:*:*:*:*:*:jenkins:*:*up to 4.8.0.149VulnerableJenkins
  • cpe:2.3:a:jenkins:ns-nd_integration_performance_publisher:*:*:*:*:*:jenkins:*:* Versions up to 4.8.0.149 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-gqxr-hvrw-6hfh io.jenkins.plugins:cavisson-ns-nd-integration (Maven) Fixed in 4.11.0.48 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-33000
  2. 2026-10-03 Alias added: GHSA-gqxr-hvrw-6hfh

References

Advisory 2

  • TI-2022-19738 Missing authorization in Jenkins NS-ND Integration Performance Publisher Plugin CVSS 3.1HIGH 8.8
  • TI-2022-19737 Cross-site request forgery in Jenkins NS-ND Integration Performance Publisher Plugin CVSS 3.1HIGH 8.8
  • TI-2022-22357 Improper certificate validation in Jenkins NS-ND Integration Performance Publisher Plugin CVSS 3.1HIGH 7.5
  • TI-2022-18199 Improper certificate validation in Jenkins NS-ND Integration Performance Publisher Plugin CVSS 3.1HIGH 7.5
  • TI-2022-22358 Insufficiently protected credentials in Jenkins NS-ND Integration Performance Publisher… CVSS 3.1MEDIUM 6.5
  • TI-2022-19739 Cross-site scripting in Jenkins NS-ND Integration Performance Publisher Plugin CVSS 3.1MEDIUM 5.4
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences