CVE-2022-45392

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-453933.5A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs.CVE-2022-453944.3A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs.CVE-2022-453959.8Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2022-453969.8Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2022-453979.8Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) att CVE-2022-453984.3A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded CVE-2022-453994.3A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statis CVE-2022-454009.8Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2022-454015.4Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS CVE-2022-454026.1In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.CVE-2022-454036.5Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media c CVE-2022-454046.5Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the