CVE-2022-38666 SSL/TLS certificate validation unconditionally disabled by Jenkins NS-ND Integration Performance Publisher Plugin

What is CVE-2022-38666?

CVE-2022-38666 is a high-severity vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin, published on 15 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features.

Weakness: CWE-295

Which versions are affected by CVE-2022-38666?

2 open source packages ship an affected version, including org.jenkins-ci.main:cavisson-ns-nd-integration. It affects 1 product.

Products include Jenkins Ns-Nd Integration Performance Publisher.

How do I fix CVE-2022-38666?

No fix has been published for CVE-2022-38666 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-38666 being exploited?

There is no known exploitation of CVE-2022-38666 in the wild and no public exploit code.

Other vulnerabilities in Jenkins NS-ND Integration Performance Publisher Plugin

• CVE-2022-41227 Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-Site Request Forgery High 8.8
• CVE-2022-41228 Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Missing Authorization High 8.8
• CVE-2023-33000 Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking High 7.5
• CVE-2022-45391 Jenkins NS-ND Integration Performance Publisher Plugin disables SSL/TLS certificate validation globally and unconditionally High 7.5
• CVE-2022-45392 Plaintext Storage of a Password in Jenkins NS-ND Integration Performance Publisher Plugin Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vj5r-mmp4-3hrx.