CVE-2022-38666

The NS-ND Integration Performance Publisher Plugin for Jenkins, versions 4.8.0.146 and earlier, unconditionally disables SSL/TLS certificate and hostname validation for several of its features [1][2]. This means the plugin does not verify the authenticity of SSL/TLS certificates presented by remote servers, nor does it check that the hostname in the certificate matches the expected server hostname.

An attacker with the ability to intercept network traffic between a Jenkins controller or agent and the plugin's target servers can perform a man-in-the-middle (MITM) attack [1][2]. Because certificate validation is completely disabled, the attacker can present a forged or self-signed certificate without detection. No special privileges on Jenkins are required beyond network positioning; the vulnerability exists in the plugin's default configuration.

Successful exploitation allows the attacker to eavesdrop on, modify, or inject data into the communication between Jenkins and the plugin's external services [1][2]. This could lead to disclosure of sensitive information, corruption of performance test results, or further compromise of the Jenkins environment.

The vulnerability is addressed in plugin version 4.8.0.147 [2]. Users should upgrade to this version or later to restore proper SSL/TLS verification. There is no workaround available in the affected versions; updating the plugin is the only mitigation [1].