CVE-2022-41229: Jenkins NS-ND Integration Performance Publisher Plugin Cross-site Scripting
Summary
CVE-2022-41229: Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-site Scripting. Affects io.jenkins.plugins:cavisson-ns-nd-integration versions < 4.8.0.147. Fixed in 4.8.0.147. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins NS-ND Integration Performance Publisher Plugin is a Maven package (io.jenkins.plugins:cavisson-ns-nd-integration) that provides integration with NetStorm/NetCloud Test for performance testing. It allows users to execute performance tests as part of their Jenkins build process. The plugin is vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability (CVE-2022-41229) in the Jenkins NS-ND Integration Performance Publisher Plugin arises from a failure to properly escape configuration options in the Execute NetStorm/NetCloud Test build step. This allows attackers with Item/Configure permission to inject malicious scripts into the plugin's configuration, leading to a stored XSS vulnerability. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to session hijacking, data theft, or other malicious actions.
How To Fix
Latest published version: 4.11.0.48 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.8.0.147
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the plugin to the latest version.
Conclusion
The Jenkins NS-ND Integration Performance Publisher Plugin is vulnerable to a stored cross-site scripting (XSS) attack. To mitigate this vulnerability, users should update the plugin to version 4.8.0.147 or later. It is recommended to stay informed about security vulnerabilities and apply necessary updates to ensure the security of your Jenkins installation.
See every vulnerability recorded for io.jenkins.plugins:cavisson-ns-nd-integration →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to session hijacking, data theft, or other malicious actions.
Users of Jenkins who have the Jenkins NS-ND Integration Performance Publisher Plugin installed and have Item/Configure permission are affected by this vulnerability.
There is no known public exploit for this vulnerability at the time of this report.
The only effective mitigation is to update the Jenkins NS-ND Integration Performance Publisher Plugin to the fixed version.
You can find more information about this vulnerability in the CVE-2022-41229 advisory and the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:cavisson-ns-nd-integration.
