CVE-2022-45391: 
Java vulnerability analysis and mitigation

CVE-2022-45391 affects the Jenkins NS-ND Integration Performance Publisher Plugin versions 4.8.0.143 and earlier. The vulnerability was discovered and disclosed on November 15, 2022, impacting the Jenkins automation server environment. This security issue involves the plugin globally and unconditionally disabling SSL/TLS certificate and hostname validation for the entire Jenkins controller Java Virtual Machine (JVM) (Jenkins Advisory, NVD).

The vulnerability has been assigned a Medium severity rating with a CVSS v3.1 Base Score of 7.5 (HIGH). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating network accessibility, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is classified under CWE-295 (Improper Certificate Validation) (NVD).

The vulnerability compromises the security of SSL/TLS connections across the entire Jenkins controller JVM by disabling certificate and hostname validation. This could potentially allow attackers to perform man-in-the-middle attacks, intercept sensitive data, or bypass security measures that rely on SSL/TLS validation (Jenkins Advisory).

The vulnerability has been fixed in NS-ND Integration Performance Publisher Plugin version 4.8.0.146, which no longer disables SSL/TLS certificate and hostname validation globally. Users are strongly advised to upgrade to this version to restore proper SSL/TLS security controls (Jenkins Advisory).