Description

A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials.

Remediation

References

https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2737

Related Vulnerabilities

CVE-2018-1000110 Vulnerability in maven package org.jenkins-ci.plugins:git

CVE-2022-32533 Vulnerability in maven package org.apache.portals.jetspeed-2:jetspeed

CVE-2018-6341 Vulnerability in maven package org.webjars.npm:vue

CVE-2015-0226 Vulnerability in maven package org.apache.wss4j:wss4j-ws-security-dom

CVE-2019-10295 Vulnerability in maven package org.jenkins-ci.plugins:crittercism-dsym

Severity

Critical

Classification

CWE-862 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory