CVE-2022-41227: Jenkins NS-ND Integration Performance Publisher Plugin Cross-Site Request Forgery
Summary
CVE-2022-41227: Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-Site Request Forgery. Affects io.jenkins.plugins:cavisson-ns-nd-integration versions < 4.8.0.130. Fixed in 4.8.0.130. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins NS-ND Integration Performance Publisher Plugin is a Maven package that integrates with Jenkins, a popular open-source automation server. This plugin allows users to publish performance test results from Cavisson NetStorm and NetDiagnostics to Jenkins. It provides valuable insights into application performance and helps identify bottlenecks and performance issues. However, versions 4.8.0.129 and earlier of the plugin are vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the Jenkins NS-ND Integration Performance Publisher Plugin allows attackers to perform CSRF attacks. By exploiting this vulnerability, an attacker can connect to a web server of their choice using attacker-specified credentials. This can lead to unauthorized access, data leakage, and potential compromise of the Jenkins server. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.8.0.130
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest secure version of the plugin.
Conclusion
The Jenkins NS-ND Integration Performance Publisher Plugin is vulnerable to a cross-site request forgery (CSRF) attack. Upgrading to version 4.8.0.130 or later of the plugin is crucial to mitigate this vulnerability. It is recommended to apply the fix promptly to ensure the security of your Jenkins installation. For additional support, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:cavisson-ns-nd-integration →
FAQ
This vulnerability allows attackers to perform CSRF attacks and potentially gain unauthorized access to the Jenkins server. It can lead to data leakage and compromise the integrity and availability of the server.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is essential to apply the recommended fix to mitigate the risk.
Yes, this vulnerability can be exploited remotely by an attacker. They can craft malicious requests to perform CSRF attacks and connect to an attacker-specified web server.
For further support and assistance in vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and help ensure your Jenkins installation is secure.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:cavisson-ns-nd-integration.
