High severityNVD Advisory· Published Sep 21, 2022· Updated May 28, 2025

CVE-2022-41229

Description

Jenkins NS-ND Integration Performance Publisher Plugin before 4.8.0.135 has a stored XSS due to unescaped configuration options in the Execute NetStorm/NetCloud Test build step.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jenkins NS-ND Integration Performance Publisher Plugin before 4.8.0.135 has a stored XSS due to unescaped configuration options in the Execute NetStorm/NetCloud Test build step.

The Jenkins NS-ND Integration Performance Publisher Plugin version 4.8.0.134 and earlier fails to escape configuration options in the 'Execute NetStorm/NetCloud Test' build step. This allows attackers who have the Item/Configure permission to inject malicious HTML and JavaScript into those options, which are stored and later rendered in the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability [1][3].

Exploitation requires an attacker to have at least Item/Configure permission on a Jenkins job that uses the affected build step. The attacker can then insert a crafted payload into a configuration field, such as a URL or test name. When a user with higher privileges views the job configuration or build history, the stored script executes in their browser, potentially leading to further compromise [1].

A successful XSS attack can allow the attacker to perform actions on behalf of the victim user, such as modifying job configurations, triggering builds, or accessing credentials stored in Jenkins. This could lead to full compromise of the Jenkins controller and its managed agents [1].

The vulnerability has been fixed in plugin version 4.8.0.135, which properly escapes configuration options before displaying them. Users should upgrade to this version or later [2][4]. As of this writing, no workarounds are documented, so updating is the recommended mitigation.

References

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.jenkins.plugins:cavisson-ns-nd-integrationMaven	< 4.8.0.147	4.8.0.147

Affected products

ghsa-coords
pkg:maven/io.jenkins.plugins/cavisson-ns-nd-integration
Range: < 4.8.0.147
Jenkins Project/NS-ND Integration Performance Publisher Plugincpe-rescue
Range: unspecified

Patches

d77c6c7a279d

Fix security issue 2858,2910,2912

https://github.com/jenkinsci/cavisson-ns-nd-integration-pluginDeepak BhartiNov 16, 2022via ghsa

commit

13 files changed · +118 −67

src/main/java/com/cavisson/jenkins/BaseConnection.java+2 −2 modified

@@ -94,7 +94,7 @@ public static synchronized URLConnection getConnections(URL url, boolean skipSSL
 					((HttpsURLConnection) urlConnection).setSSLSocketFactory(getSkipSSLVerficationSSLCtx());
 				}
 
-				if (skipSSLHostValidation) {
+				if (skipSSLCertValidation || skipSSLHostValidation) {
 					((HttpsURLConnection) urlConnection).setHostnameVerifier(getSkipHostCheckVerifier());
 				}
 			}
@@ -105,4 +105,4 @@ public static synchronized URLConnection getConnections(URL url, boolean skipSSL
 		return urlConnection;
 	}
 
-}
\ No newline at end of file
+}

src/main/java/com/cavisson/jenkins/CreateVirtualService.java+2 −2 modified

@@ -246,9 +246,9 @@ public void perform(Run<?, ?> run, FilePath workspace, Launcher launcher, TaskLi
 							// Execution test Suite

 							NetStormConnectionManager netstormConnectionManger = new NetStormConnectionManager(URLHOST,

 									getUsername(), getPassword(), project, subProject, scenario, "T",

-									"", "20", "system", "", true, false, true, "");

+									"", "20", "system", "", true, false, true,true, "");

 

-							result = netstormConnectionManger.startNetstormTest(errMsg, logg, "");

+							result = netstormConnectionManger.startNetstormTest(errMsg, logg, "", run);

 

 							NetStormBuilder nsb = new NetStormBuilder(URLHOST, getUsername(), getPassword().getPlainText(), project,

 									subProject, scenario, "T", "", "20", "system", true);

src/main/java/com/cavisson/jenkins/NdConnectionManager.java+2 −2 modified

@@ -55,8 +55,8 @@ public class NdConnectionManager extends BaseConnection{
   private String warning;

   private String overall;

   private String err = "Connection failure, please check whether Connection URI is specified correctly";

-  private boolean skipSSLCertValidation = false;

-  private boolean skipSSLHostValidation = false;

+  private boolean skipSSLCertValidation = true;

+  private boolean skipSSLHostValidation = true;

   

    public String getCritical() {

     return critical;

src/main/java/com/cavisson/jenkins/NetDiagnosticsResultsPublisher.java+2 −2 modified

@@ -497,7 +497,7 @@ public FormValidation doCheckBaseEndTime(@QueryParameter final String baseEndTim
  Need to test connection on given credientials
  */
 @POST
-public FormValidation doTestNetDiagnosticsConnection(@QueryParameter("netdiagnosticsUri") final String netdiagnosticRestUri, @QueryParameter("username") final String username, @QueryParameter("password") String password, @QueryParameter("curStartTime") final String curStartTime,@QueryParameter("curEndTime") final String curEndTime,@QueryParameter("baseStartTime") final String baseStartTime,@QueryParameter("baseEndTime") final String baseEndTime,@QueryParameter("criThreshold") final String criThreshold,@QueryParameter("warThreshold") final String warThreshold,@QueryParameter("failThreshold") final String failThreshold,@QueryParameter("initDuration") final Boolean initDuration,@QueryParameter("initStartTime") final String initStartTime,@QueryParameter("initEndTime") final String initEndTime, @QueryParameter("SSLDisable") final boolean SSLDisable) 
+public FormValidation doTestNetDiagnosticsConnection(@QueryParameter("netdiagnosticsUri") final String netdiagnosticRestUri, @QueryParameter("username") final String username, @QueryParameter("password") String password, @QueryParameter("curStartTime") final String curStartTime,@QueryParameter("curEndTime") final String curEndTime,@QueryParameter("baseStartTime") final String baseStartTime,@QueryParameter("baseEndTime") final String baseEndTime,@QueryParameter("criThreshold") final String criThreshold,@QueryParameter("warThreshold") final String warThreshold,@QueryParameter("failThreshold") final String failThreshold,@QueryParameter("initDuration") final Boolean initDuration,@QueryParameter("initStartTime") final String initStartTime,@QueryParameter("initEndTime") final String initEndTime, @QueryParameter("skipSSLCertCheck") final boolean skipSSLCertCheck, @QueryParameter("skipSSLHostCheck") final boolean skipSSLHostCheck) 
 {
   Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER); 
   FormValidation validationResult;
@@ -549,7 +549,7 @@ else if (!(netdiagnosticRestUri.startsWith("http://") || netdiagnosticRestUri.st
   }
   
   
-  NdConnectionManager connection = new NdConnectionManager(netdiagnosticRestUri, username, Secret.fromString(password), true, SSLDisable, true);
+  NdConnectionManager connection = new NdConnectionManager(netdiagnosticRestUri, username, Secret.fromString(password), true, skipSSLCertCheck, skipSSLHostCheck);
   
   String check = netdiagnosticRestUri + "@@" + username +"@@" + password;
   if (!connection.testNDConnection(errMsg, check, logger))

src/main/java/com/cavisson/jenkins/NetStormBuilder.java+45 −21 modified

@@ -107,7 +107,8 @@ public class NetStormBuilder extends Builder implements SimpleBuildStep {
 	private String dataDir = "";

 	private String checkRuleFileUpload = "";

 	private boolean fileUpload = false;

-	private final boolean SSLDisable;

+	private boolean skipSSLCertCheck = true;

+	private boolean skipSSLHostCheck = true;

 	private static String ErrorMsg = "Error";

 	NetStormConnectionManager netstormConnectionManger = null;

 	/*Contains testsuite list*/

@@ -116,7 +117,7 @@ public class NetStormBuilder extends Builder implements SimpleBuildStep {
 	HashMap<String, ParameterDTO> testsuiteParameterMap = new HashMap<String, ParameterDTO>();

 

 

-	public NetStormBuilder(String URLConnectionString, String username, String password, String project,

+	public NetStormBuilder(String URLConnectionString, String username, Object password, String project,

 			String subProject, String scenario, String testMode, String baselineType, String pollInterval, String protocol,

 			String repoIp, String repoPort, String repoPath, String repoUsername, String repoPassword, String profile,String script,String page,String advanceSett,String urlHeader,String hiddenBox,String gitPull, boolean generateReport,String testProfileBox) {

 		logger.log(Level.FINE, "Cavisson-Plugin|constructor called.");

@@ -125,7 +126,12 @@ public NetStormBuilder(String URLConnectionString, String username, String passw
 		this.scenario = scenario;

 		this.URLConnectionString = URLConnectionString;

 		this.username = username;

-		this.password = StringUtils.isEmpty(password) ? null : Secret.fromString(password);

+		if( password instanceof Secret) {

+                        this.password=(Secret)password;

+                }

+                else {

+                        this.password = StringUtils.isEmpty(password.toString()) ? null : Secret.fromString(password.toString());

+                }

 		this.testMode = testMode;

 		this.baselineType = baselineType;

 		this.pollInterval = pollInterval;

@@ -144,11 +150,12 @@ public NetStormBuilder(String URLConnectionString, String username, String passw
 		this.hiddenBox = hiddenBox;

 		this.testProfileBox = testProfileBox;

 		this.generateReport = generateReport;

-		this.SSLDisable = true;

+		this.skipSSLCertCheck = true;

+	        this.skipSSLHostCheck = true;

 	}

 

 

-	public NetStormBuilder(String URLConnectionString, String username, String password, String project,

+	public NetStormBuilder(String URLConnectionString, String username, Object password, String project,

 			String subProject, String scenario, String testMode, String baselineType, String pollInterval, String protocol,

 			String repoIp, String repoPort, String repoPath, String repoUsername, String repoPassword, String profile,String script,String page,String advanceSett,String urlHeader,String hiddenBox,String gitPull, boolean generateReport, Map<String, String> envVarMap, boolean doNotWaitForTestCompletion ,String testProfileBox) {

 		logger.log(Level.FINE, "Cavisson-Plugin|Constructor called.");

@@ -157,7 +164,12 @@ public NetStormBuilder(String URLConnectionString, String username, String passw
 		this.scenario = scenario;

 		this.URLConnectionString = URLConnectionString;

 		this.username = username;

-		this.password = StringUtils.isEmpty(password) ? null : Secret.fromString(password);

+		if( password instanceof Secret) {

+                        this.password=(Secret)password;

+                }

+                else {

+                        this.password = StringUtils.isEmpty(password.toString()) ? null : Secret.fromString(password.toString());

+                }

 		this.testMode = testMode;

 		this.baselineType = baselineType;

 		this.pollInterval = pollInterval;

@@ -178,7 +190,8 @@ public NetStormBuilder(String URLConnectionString, String username, String passw
 		this.generateReport = generateReport;

 		this.envVarMap = envVarMap;

 		this.doNotWaitForTestCompletion = doNotWaitForTestCompletion;

-		this.SSLDisable = true;

+		this.skipSSLCertCheck = true;

+                this.skipSSLHostCheck = true;

 	}

 

 	@DataBoundConstructor

@@ -187,7 +200,7 @@ public NetStormBuilder(String URLConnectionString, String username, Object passw
 			String repoIp, String repoPort, String repoPath, String repoUsername, String repoPassword, String profile,

 			String script,String page,String advanceSett,String urlHeader,String hiddenBox,String gitPull, boolean generateReport, String testProfileBox, boolean doNotWaitForTestCompletion,

 			String totalusers, String rampUpSec, String rampupmin,String rampuphour, String duration, String serverhost, 

-			String sla, String testName, String scriptPath, String  rampupDuration, String emailid, String emailidCC, String emailidBcc, String testsuite, String dataDir, String checkRuleFileUpload, boolean SSLDisable) {

+			String sla, String testName, String scriptPath, String  rampupDuration, String emailid, String emailidCC, String emailidBcc, String testsuite, String dataDir, String checkRuleFileUpload, boolean skipSSLCertCheck, boolean skipSSLHostCheck) {

 

 		logger.log(Level.FINE,"Cavisson-Plugin|Constructor called.");

 		this.project = project;

@@ -238,26 +251,33 @@ public NetStormBuilder(String URLConnectionString, String username, Object passw
 		this.testsuite = testsuite;

 		this.dataDir = dataDir;

 		this.checkRuleFileUpload = checkRuleFileUpload;

-		this.SSLDisable = SSLDisable;

+		this.skipSSLCertCheck = skipSSLCertCheck;

+		this.skipSSLHostCheck = skipSSLHostCheck;

 

 		this.setParametersValue();

 	}

 

-	public NetStormBuilder(String URLConnectionString, String username, String password, String project,

+	public NetStormBuilder(String URLConnectionString, String username, Object password, String project,

 			String subProject, String scenario, String testMode, String baselineType, String pollInterval,String profile, boolean generateReport) {

 		logger.log(Level.FINE, "Cavisson-Plugin|Constructor called.");

 		this.project = project;

 		this.subProject = subProject;

 		this.scenario = scenario;

 		this.URLConnectionString = URLConnectionString;

 		this.username = username;

-		this.password = StringUtils.isEmpty(password) ? null : Secret.fromString(password);

+		if( password instanceof Secret) {

+                        this.password=(Secret)password;

+                }

+                else {

+                        this.password = StringUtils.isEmpty(password.toString()) ? null : Secret.fromString(password.toString());

+                }

 		this.testMode = testMode;

 		this.baselineType = baselineType;

 		this.pollInterval = pollInterval;

 		this.profile = profile; 

 		this.generateReport = generateReport;

-		this.SSLDisable = true;

+		this.skipSSLCertCheck = true;

+                this.skipSSLHostCheck = true;

 	}

 	

     static String getTestRunNumber() {

@@ -437,10 +457,14 @@ public void setDoNotWaitForTestCompletion(boolean doNotWaitForTestCompletion) {
 		this.doNotWaitForTestCompletion = doNotWaitForTestCompletion;

 	}

 

-	public boolean isSSLDisable() {

-		return SSLDisable;

+	public boolean isSkipSSLCertCheck() {

+		return skipSSLCertCheck;

 	}

-	

+

+	public boolean isSkipSSLHostCheck() {

+		return skipSSLHostCheck;

+	}

+

 	public Map<String, String> getEnvVarMap() {

 		return envVarMap;

 	}

@@ -655,7 +679,7 @@ public void perform(Run<?, ?> run, FilePath fp, Launcher lnchr, TaskListener tas
 		String serverhost = "";

 		

 		if(keyset.size() > 0) {

-			netstormConnectionManger = new NetStormConnectionManager(URLConnectionString, username, password, project, subProject, scenario, testMode, baselineType, pollInterval,profile,hiddenBox,generateReport, doNotWaitForTestCompletion, SSLDisable, gitPull);      

+			netstormConnectionManger = new NetStormConnectionManager(URLConnectionString, username, password, project, subProject, scenario, testMode, baselineType, pollInterval,profile,hiddenBox,generateReport, doNotWaitForTestCompletion, skipSSLCertCheck, skipSSLHostCheck, gitPull);      

 		}

 

 		/*This parameter is for parameterizing testsuite and user can give multiple testsuites to execute in form of comma seaprated.*/

@@ -1171,7 +1195,7 @@ else if(envValue.startsWith("EMAIL_IDS_BCC")) {
 			result = netstormConnectionManger.startMultipleTest(errMsg ,logg, repoPath);

 			// JSONObject requestObj = getTestsuiteJson();  

 		} else{

-			result = netstormConnectionManger.startNetstormTest(errMsg ,logg, repoPath);

+			result = netstormConnectionManger.startNetstormTest(errMsg ,logg, repoPath, run);

 		}

 

 

@@ -1319,7 +1343,7 @@ public void processTestResult(HashMap result, PrintStream logg, FilePath fp, Run
 	public void setParametersValue() {

 		try {

 			logger.log(Level.FINE, "Cavisson-Plugin|Getting parameter values of pipeline job");

-			netstormConnectionManger = new NetStormConnectionManager(URLConnectionString, username, password, project, subProject, scenario, testMode, baselineType, pollInterval,profile,hiddenBox,generateReport, doNotWaitForTestCompletion, SSLDisable, gitPull);      

+			netstormConnectionManger = new NetStormConnectionManager(URLConnectionString, username, password, project, subProject, scenario, testMode, baselineType, pollInterval,profile,hiddenBox,generateReport, doNotWaitForTestCompletion, skipSSLCertCheck, skipSSLHostCheck, gitPull);      

 			

 			/*Checking Testsuite parameter is applied or not*/

 			if(testsuite != null && !testsuite.isEmpty()) {

@@ -1948,7 +1972,7 @@ public String  startTest(NetStormConnectionManager netstormConnectionManger) {
 				//NetStormConnectionManager netstormConnectionManger = new NetStormConnectionManager(URLConnectionString, username, password,

 				//project, subProject, scenario, testMode, baselineType, pollInterval);

 

-				 result =   netstormConnectionManger.startNetstormTest(errBuf , pout, repoPath);

+				 result =   netstormConnectionManger.startNetstormTest(errBuf , pout, repoPath, null);

 

 

 				if(result.get("TESTRUN") != null && !result.get("TESTRUN").toString().trim().equals(""))

@@ -2193,13 +2217,13 @@ public JSONObject performGitpull(String URLConnectionString,String username,Stri
 		 * @return

 		 */

 		@POST

-		public FormValidation doTestNetstormConnection(@QueryParameter("URLConnectionString") final String URLConnectionString, @QueryParameter("username") final String username, @QueryParameter("password") String password, @QueryParameter("SSLDisable") boolean SSLDisable) {

+		public FormValidation doTestNetstormConnection(@QueryParameter("URLConnectionString") final String URLConnectionString, @QueryParameter("username") final String username, @QueryParameter("password") final String password, @QueryParameter("skipSSLCertCheck") final boolean skipSSLCertCheck, @QueryParameter("skipSSLHostCheck") final boolean skipSSLHostCheck) {

 

 			Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);	

 			FormValidation validationResult;

 

 

-			NetStormConnectionManager netstormConnectionManger = new NetStormConnectionManager(URLConnectionString, username, Secret.fromString(password), false, 15, SSLDisable, true);

+			NetStormConnectionManager netstormConnectionManger = new NetStormConnectionManager(URLConnectionString, username, Secret.fromString(password), false, 15, skipSSLCertCheck, skipSSLHostCheck);

 

 			StringBuffer errMsg = new StringBuffer();

src/main/java/com/cavisson/jenkins/NetStormConnectionManager.java+18 −12 modified

@@ -114,8 +114,8 @@ public class NetStormConnectionManager extends BaseConnection{
 	HashMap<String, ParameterDTO> testsuiteParameterDTO = null;

 	private String job_id = "";

 	private String errMsg = "";

-	private boolean skipSSLCertValidation = false;

-	private boolean skipSSLHostValidation = false;

+	private boolean skipSSLCertValidation = true;

+	private boolean skipSSLHostValidation = true;

 

 

 	private HashMap<String,String> slaValueMap =  new HashMap<String,String> ();

@@ -408,10 +408,10 @@ public NetStormConnectionManager(String URLConnectionString, String username, Se
 		this.durationPhase = durationPhase;

 		this.timeout = timeout;

 		this.skipSSLCertValidation = skipSSLCertValidation;

-	    this.skipSSLHostValidation = skipSSLHostValidation;

+	        this.skipSSLHostValidation = skipSSLHostValidation;

 	}

 

-	public NetStormConnectionManager(String URLConnectionString, String username, Secret password, String project, String subProject, String scenario, String testMode, String baselineType, String pollInterval, String profile,String hiddenBox, boolean generateReport, boolean doNotWaitforTestCompletion, boolean SSLDisable, String... gitPull)

+	public NetStormConnectionManager(String URLConnectionString, String username, Secret password, String project, String subProject, String scenario, String testMode, String baselineType, String pollInterval, String profile,String hiddenBox, boolean generateReport, boolean doNotWaitforTestCompletion, boolean skipSSLCertValidation, boolean skipSSLHostValidation, String... gitPull)

 	{

 		logger.log(Level.FINE, "Cavisson-Plugin|NetstormConnectionManger constructor called with parameters with username:{0}, project:{2}, subProject:{3}, scenario:{4}, baselineTR:{5}", new Object[]{username, project, subProject, scenario, baselineType});

 		this.URLConnectionString = URLConnectionString;

@@ -428,8 +428,8 @@ public NetStormConnectionManager(String URLConnectionString, String username, Se
 		this.gitPull = (gitPull.length > 0) ? gitPull[0] : "false";

 		this.generateReport = generateReport;

 		this.doNotWaitforTestCompletion = doNotWaitforTestCompletion;

-		this.skipSSLCertValidation = SSLDisable;

-		this.skipSSLHostValidation = SSLDisable;

+		this.skipSSLCertValidation = skipSSLCertValidation;

+		this.skipSSLHostValidation = skipSSLHostValidation;

 	}

 

 	/**

@@ -479,7 +479,7 @@ private boolean checkAndMakeConnection(String urlString, String servletPath, Str
 			return false;

 		} catch (IOException e) {

 			logger.log(Level.SEVERE, "Cavisson-Plugin|Unknown exception in establishing connection. IOException -", e);

-      errMsg.append("\""+e.getMessage()+"\". |");

+			errMsg.append("| SSL Handshake Failed | Error: \""+e.getMessage()+"\". | ");

 			return false;

 		} catch (Exception e) {

 			logger.log(Level.SEVERE, "Cavisson-Plugin|Unknown exception in establishing connection.", e);

@@ -1361,7 +1361,7 @@ public ArrayList<String> getScenarioList(StringBuffer errMsg , String project, S
 		return null;

 	}

 

-	public HashMap startNetstormTest(StringBuffer errMsg , PrintStream consoleLogger, String repoPath)

+	public HashMap startNetstormTest(StringBuffer errMsg , PrintStream consoleLogger, String repoPath,Run<?, ?> run)

 	{

 		logger.log(Level.INFO, "Cavisson-Plugin|Starting Netstorm Test on server with scenario or testsuite name: " + scenario);

 

@@ -1481,6 +1481,12 @@ public HashMap startNetstormTest(StringBuffer errMsg , PrintStream consoleLogger
 				logger.log(Level.SEVERE, "Cavisson-Plugin|Unknown exception in establishing connection. MalformedURLException -", e);

 			} catch (IOException e) {

 				logger.log(Level.SEVERE, "Cavisson-Plugin|Unknown exception in establishing connection. IOException -", e);

+        if(run != null){

+          consoleLogger.println("Cavisson-Plugin|Unknown exception in establishing connection. IOException - " +e.getMessage());

+          run.setDescription(e.getMessage());

+          run.setResult(Result.FAILURE);

+          return resultMap;

+        }

 			} catch (Exception e) {

 				logger.log(Level.SEVERE, "Cavisson-Plugin|Unknown exception in establishing connection.", e);

 			}

@@ -2079,9 +2085,9 @@ public void run()
 

 									/*Getting TestRun, if not available.*/

 									if (testRun <= 0) {

-										testRun = pollResponse.getInt("testRun");

+										testRun = Integer.parseInt(pollResponse.getString("testRun"));

 										int stopTR = -1;

-										stopTR = pollResponse.getInt("testRun");

+										stopTR = Integer.parseInt(pollResponse.getString("testRun"));

 										String portStr = getUrlString();

 										new BuildActionStopTest(stopTR,username,portStr);

 									}

@@ -2216,9 +2222,9 @@ public void run()
 

 									/*Getting TestRun, if not available.*/

 									if (testRun <= 0) {

-										testRun = pollResponse.getInt("testRun");

+										testRun = Integer.parseInt(pollResponse.getString("testRun"));

 										int stopTR = -1;

-										stopTR = pollResponse.getInt("testRun");

+										stopTR = Integer.parseInt(pollResponse.getString("testRun"));

 										logger.log(Level.FINE, "Cavisson-Plugin|Testrun to stop = " + stopTR);

 										String portStr = getUrlString();

 										new BuildActionStopTest(stopTR,username,portStr);

src/main/java/com/cavisson/jenkins/NetStormResultsPublisher.java+8 −3 modified

@@ -79,9 +79,14 @@ public Secret getPassword()
       return password;

     }

     

-  public void setPassword(final String password) 

+  public void setPassword(final Object password) 

   {

-	  this.password =  StringUtils.isEmpty(password) ? null : Secret.fromString(password);

+	  if( password instanceof Secret) {

+                        this.password=(Secret)password;

+           }

+          else {

+                        this.password = StringUtils.isEmpty(password.toString()) ? null : Secret.fromString(password.toString());

+           }

   }

 

   

@@ -261,7 +266,7 @@ else if (!(netstormRestUri.startsWith("http://") || netstormRestUri.startsWith("
  private String timeout = "15";

   

  @DataBoundConstructor

- public NetStormResultsPublisher(final String netstormUri, final String username,String password, final JSONObject htmlTable,final String project, final String subProject, final String scenario, final boolean  durationReport, final String profile, final String timeout)

+ public NetStormResultsPublisher(final String netstormUri, final String username,Object password, final JSONObject htmlTable,final String project, final String subProject, final String scenario, final boolean  durationReport, final String profile, final String timeout)

  {

    System.out.println(" getting constructor parmeter== "+netstormUri +", username = "+username+", project = "+project+", subProject = " +subProject+", timeout = "+timeout);

      logger.log(Level.FINE, "Cavisson-Plugin|duration check = " + durationReport + ", uri = " + netstormUri+", profile -"+profile);

src/main/java/com/cavisson/jenkins/NSNDIntegrationResultsPublisher.java+2 −2 modified

@@ -484,7 +484,7 @@ public FormValidation doCheckBaseEndTime(@QueryParameter final String baseEndTim
  Need to test connection on given credientials

  */

 @POST

-public FormValidation doTestNsNdIntegratedConnection(@QueryParameter("nsIntegrationUri") final String nsIntegrationUri, @QueryParameter("nsUsername") final String nsUsername, @QueryParameter("nsPassword") String nsPassword, @QueryParameter("ndIntegrationUri") final String ndIntegrationUri, @QueryParameter("ndUsername") final String ndUsername, @QueryParameter("ndPassword") String ndPassword, @QueryParameter("SSLDisable") final boolean SSLDisable) 

+public FormValidation doTestNsNdIntegratedConnection(@QueryParameter("nsIntegrationUri") final String nsIntegrationUri, @QueryParameter("nsUsername") final String nsUsername, @QueryParameter("nsPassword") String nsPassword, @QueryParameter("ndIntegrationUri") final String ndIntegrationUri, @QueryParameter("ndUsername") final String ndUsername, @QueryParameter("ndPassword") String ndPassword, @QueryParameter("skipSSLCertCheck") final boolean skipSSLCertCheck, @QueryParameter("skipSSLHostCheck") final boolean skipSSLHostCheck) 

 {

   Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);

   FormValidation validationResult;

@@ -529,7 +529,7 @@ else if (!(ndIntegrationUri.startsWith("http://") || ndIntegrationUri.startsWith
     return validationResult = FormValidation.error("Please enter password.");

   }

     

-  NSNDIntegrationConnectionManager connection = new NSNDIntegrationConnectionManager(nsIntegrationUri, nsUsername, Secret.fromString(nsPassword), ndIntegrationUri, ndUsername, Secret.fromString(ndPassword), null, SSLDisable, true);

+  NSNDIntegrationConnectionManager connection = new NSNDIntegrationConnectionManager(nsIntegrationUri, nsUsername, Secret.fromString(nsPassword), ndIntegrationUri, ndUsername, Secret.fromString(ndPassword), null, skipSSLCertCheck, skipSSLHostCheck);

   

   String check = ndIntegrationUri + "@@" + ndUsername +"@@" + ndPassword;

src/main/resources/com/cavisson/jenkins/BuildActionResultsDisplay/index.jelly+1 −1 modified

@@ -444,7 +444,7 @@
                      <td align='right' style='background:#FFFFFF;' tooltip='h.escape(${suit_metric.transactionTooltip})'>${suit_metric.transactiontStatus} </td>

                   </j:if>

               </j:if>

-            <td  style="background:#FFFFFF;color:blue;cursor:pointer;" > 

+            <td  style="background:#FFFFFF;color:blue;cursor:pointer;" ></td> 

             </tr>

             </j:if>

             </j:if>

src/main/resources/com/cavisson/jenkins/NetDiagnosticsResultsPublisher/config.jelly+8 −4 modified

@@ -56,14 +56,18 @@
    </f:entry>

    

   <j:if test="true">

-   <f:entry title="Proceed to continue without SSL">

-     <f:checkbox id="SSLDisable" field="SSLDisable" checked="${instance.SSLDisable}" default="false"/><i class = "fa fa-question" style="color:blue;cursor:pointer;margin-left:4px;" title="If you enable this option, NS will not Check SSL."></i>

-   </f:entry>

+  <f:entry title="Skip SSL Certification Check">

+  	<f:checkbox id="skipSSLCertCheck" field="skipSSLCertCheck" checked="${instance.skipSSLCertCheck}" default="true"/><i class = "fa fa-question" style="color:blue;cursor:pointer;margin-left:4px;" title="Skip SSL Certificate check. It may be needed if Cavisson endpoint has self signed certificate."></i>

+  </f:entry>

+

+  <f:entry title="Skip SSL Hostname Check">

+  	<f:checkbox id="skipSSLHostCheck" field="skipSSLHostCheck" checked="${instance.skipSSLHostCheck}" default="true"/><i class = "fa fa-question" style="color:blue;cursor:pointer;margin-left:4px;" title="Skip Host name verification. It may be needed if Cavisson endpoint doesn't have proper host name."></i>

+  </f:entry>

   </j:if>

 

   <f:validateButton

       title="${%netdiagnostics.connection.test.title}" progress="${%netdiagnostics.connection.test.progress}"

-       method="testNetDiagnosticsConnection"  with="netdiagnosticsUri,username,password,curStartTime,curEndTime,baseStartTime,baseEndTime,criThreshold,warThreshold,failThreshold,initDuration,initStartTime,initEndTime,SSLDisable" />

+       method="testNetDiagnosticsConnection"  with="netdiagnosticsUri,username,password,curStartTime,curEndTime,baseStartTime,baseEndTime,criThreshold,warThreshold,failThreshold,initDuration,initStartTime,initEndTime,skipSSLCertCheck,skipSSLHostCheck" />

 

 

 </j:jelly>

src/main/resources/com/cavisson/jenkins/NetStormBuilder/config.jelly+18 −10 modified

@@ -25,14 +25,19 @@
     <f:password field="password" id="pass"/>

   </f:entry>

   <j:if test="true">

-  <f:entry title="Proceed to continue without SSL">

-    <f:checkbox id="SSLDisable" field="SSLDisable" checked="${instance.SSLDisable}" default="false"/><i class = "fa fa-question" style="color:blue;cursor:pointer;margin-left:4px;" title="If you enable this option, NS will not Check SSL."></i>

+  <f:entry title="Skip SSL Certificate Check">

+    <f:checkbox id="skipSSLCertCheck" field="skipSSLCertCheck" checked="${instance.skipSSLCertCheck}" default="true"/><i class = "fa fa-question" style="color:blue;cursor:pointer;margin-left:4px;" title="Skip SSL Certificate Check. It may be needed if Cavisson endpoint has self signed certificate."></i>

    </f:entry>

+  

+   <f:entry title="Skip SSL Hostname Check">

+    <f:checkbox id="skipSSLHostCheck" field="skipSSLHostCheck" checked="${instance.skipSSLHostCheck}" default="true"/><i class = "fa fa-question" style="color:blue;cursor:pointer;margin-left:4px;" title="Skip SSL Hostname Check. It may be needed if Cavisson endpoint doesn't have proper host name."></i>

+   </f:entry>

+

   </j:if>

 

 <div style="justify-content:flex-end;width:100%;">

   <f:validateButton title="${%netstorm.connection.test.title}" progress="${%netstorm.connection.test.progress}"

-  method="testNetstormConnection" with="URLConnectionString,username,password,SSLDisable"/>

+  method="testNetstormConnection" with="URLConnectionString,username,password,skipSSLCertCheck,skipSSLHostCheck"/>

 </div>

 

  <f:optionalBlock name="dynamic" title="Git Configuration" checked="${instance.getGitConfigurationFromNS()}">

@@ -343,14 +348,13 @@
  		res = t.responseObject();

  		var l = res.length;

  		 if(l &gt; 0){

- 		 	var addOptions = "";

+ 		 	document.getElementById(value).innerHTML = "";

  		 	for (i in res) {

  		 	   if(i &lt; l){

-                 addOptions += "<option value="+ res[i] +">" + res[i] + "</option>";

+			var option = document.createElement('option');option.innerText=res[i];

+			document.getElementById(value).appendChild(option);

                }

             }

-            document.getElementById(value).innerHTML = "";

-            document.getElementById(value).innerHTML = addOptions;

             if(res.includes(temp)){

             	document.getElementById(value).value = temp;

             }else{

@@ -368,7 +372,7 @@
  	var subProject = document.getElementById('SP').value;

  	var testMode = document.getElementById('testMode').value;

  	var checkBox = document.getElementById("myCheck");

- 	var repoPath = document.getElementById("repourl");

+ 	var repoPath = document.getElementById("repourl").value;

  	

  	document.getElementById('gitPullMsg').innerText = "";

  	document.getElementById('gitPullMsg').style.color = "#000000";

@@ -465,8 +469,12 @@ function addRow() {
 		cell5.innerText = "NA";

 	else

 		cell5.innerText = hdrvalue;

-  	cell6.innerHTML = '<i class="fa fa-trash" onclick="deleteRow(this)"></i>';

-  	

+  	var attrObj= {

+		"class" : "fa fa-trash",

+		"onclick" : "deleteEntry(this)"

+	};

+	var deleteIcon = generateEle("i",attrObj,null,"");

+	cell6.append(deleteIcon);	

   }

   

   var rowlength = table.rows.length;

src/main/resources/com/cavisson/jenkins/NetStormBuilder/config.properties+2 −2 modified

@@ -2,8 +2,8 @@
 # To change this template file, choose Tools | Templates
 # and open the template in the editor.
 
-netstorm.url.title=Netstorm URL Connection
-netstorm.url.description=URL to connect toNetstorm Controller. By default \
+netstorm.url.title=NetStorm URL Connection
+netstorm.url.description=URL to connect to NetStorm Controller. By default \
 something like; http://host_name:8090/controller/ 
 
 netstorm.username.title=Username

src/main/resources/com/cavisson/jenkins/NSNDIntegrationResultsPublisher/config.jelly+8 −4 modified

@@ -87,15 +87,19 @@
    </f:entry>

 

    <j:if test="true">

-     <f:entry title="Proceed to continue without SSL">

-      <f:checkbox id="SSLDisable" field="SSLDisable" checked="${instance.SSLDisable}" default="false"/><i class = "fa fa-question" style="color:blue;cursor:pointer;margin-left:4px;" title="If you enable this option, NS will not Check SSL."></i>

-     </f:entry>

+    <f:entry title="Skip SSL Certification Check">

+    	<f:checkbox id="skipSSLCertCheck" field="skipSSLCertCheck" checked="${instance.skipSSLCertCheck}" default="true"/><i class = "fa fa-question" style="color:blue;cursor:pointer;margin-left:4px;" title="Skip SSL Certificate Check. It may be needed if Cavisson endpoint has self signed certificate."></i>

+   </f:entry>

+

+    <f:entry title="Skip SSL Hostname Check">

+    	<f:checkbox id="skipSSLHostCheck" field="skipSSLHostCheck" checked="${instance.skipSSLHostCheck}" default="true"/><i class = "fa fa-question" style="color:blue;cursor:pointer;margin-left:4px;" title="Skip SSL Hostname Check. It may be needed if Cavisson endpoint doesn't have proper host name."></i>

+   </f:entry>

    </j:if>

 

 

   <f:validateButton

       title="${%NDIntegration.connection.test.title}" progress="${%NDIntegration.connection.test.progress}"

-       method="testNsNdIntegratedConnection"  with="nsIntegrationUri,nsUsername,nsPassword,ndIntegrationUri,ndUsername,ndPassword,SSLDisable" />

+       method="testNsNdIntegratedConnection"  with="nsIntegrationUri,nsUsername,nsPassword,ndIntegrationUri,ndUsername,ndPassword,skipSSLCertCheck,skipSSLHostCheck" />

 

 

 </j:jelly>

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/advisories/GHSA-fq2h-r2h9-pj8rghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-41229ghsaADVISORY
github.com/jenkinsci/cavisson-ns-nd-integration-plugin/commit/d77c6c7a279da002178f8244f37093773dd6aee5ghsaWEB
www.jenkins.io/security/advisory/2022-09-21/ghsax_refsource_CONFIRMWEB

News mentions

Jenkins Security Advisory 2022-09-21
Jenkins Security Advisories · Sep 21, 2022

cvss	0.455
epss	0.008
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000