CVE-2022-41229: Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-site Scripting
8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.86387%
CWE
Published
9/22/2022
Updated
1/31/2023
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:cavisson-ns-nd-integration | maven | < 4.8.0.147 | 4.8.0.147 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability arises from improper escaping of configuration options in the Execute NetStorm/NetCloud Test build step. The identified functions are form validation handlers (annotated with @POST) that process user-supplied parameters (e.g., URLs, usernames) and return responses. Prior to the patch, these methods did not sanitize inputs, allowing attackers to inject malicious scripts. The commit diff shows changes to parameter handling and SSL configurations, but the root cause lies in the lack of escaping when rendering these parameters in the Jenkins UI. The high confidence stems from the direct link between these functions and the user-controlled configuration options described in the advisory.