CVE-2023-33000 Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking

What is CVE-2023-33000?

CVE-2023-33000 is a high-severity vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin, published on 16 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them.

Weakness: CWE-522

Which versions are affected by CVE-2023-33000?

2 open source packages ship an affected version, including io.jenkins.plugins:cavisson-ns-nd-integration. It affects 1 product.

Products include Jenkins Ns-Nd Integration Performance Publisher.

How do I fix CVE-2023-33000?

Upgrade io.jenkins.plugins:cavisson-ns-nd-integration to 4.11.0.48 or later.

Is CVE-2023-33000 being exploited?

There is no known exploitation of CVE-2023-33000 in the wild and no public exploit code.

Other vulnerabilities in Jenkins NS-ND Integration Performance Publisher Plugin

• CVE-2022-41227 Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-Site Request Forgery High 8.8
• CVE-2022-41228 Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Missing Authorization High 8.8
• CVE-2022-38666 SSL/TLS certificate validation unconditionally disabled by Jenkins NS-ND Integration Performance Publisher Plugin High 7.5
• CVE-2022-45391 Jenkins NS-ND Integration Performance Publisher Plugin disables SSL/TLS certificate validation globally and unconditionally High 7.5
• CVE-2022-45392 Plaintext Storage of a Password in Jenkins NS-ND Integration Performance Publisher Plugin Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gqxr-hvrw-6hfh.