high7.5
CVE-2023-33000
Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking
Impact
Jenkins NS-ND Integration Performance Publisher Plugin stores credentials in job config.xml files on the Jenkins controller as part of its configuration. While these credentials are stored encrypted on disk, in NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them. NS-ND Integration Performance Publisher Plugin 4.11.0.48 masks credentials displayed on the configuration form.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:cavisson-ns-nd-integration | < 4.11.0.48 | 4.11.0.48 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Ns-Nd Integration Performance Publisher | through 4.8.0.149 |