CVE-2022-45392: 
Java vulnerability analysis and mitigation

CVE-2022-45392 affects the NS-ND Integration Performance Publisher Plugin for Jenkins, specifically versions 4.8.0.143 and earlier. This security vulnerability was disclosed on November 15, 2022, as part of Jenkins Security Advisory 2022-11-15. The vulnerability is related to the insecure storage of passwords in the Jenkins controller's job configuration files (Jenkins Advisory).

The vulnerability is classified with a Medium severity CVSS score. The core issue involves the plugin storing passwords in an unencrypted format within job config.xml files on the Jenkins controller as part of its configuration. This implementation flaw exposes sensitive credential information in plaintext, making it accessible to unauthorized users (Jenkins Advisory).

The vulnerability allows attackers with Item/Extended Read permission or access to the Jenkins controller file system to view the stored passwords in plaintext. This exposure of credentials could potentially lead to unauthorized access to connected systems and services (Jenkins Advisory).

The vulnerability can be exploited by attackers who have either Item/Extended Read permission within Jenkins or physical access to the Jenkins controller file system. The attack vector requires minimal complexity as the passwords are stored in plaintext and can be directly read from the configuration files (Jenkins Advisory).

The vulnerability has been fixed in NS-ND Integration Performance Publisher Plugin version 4.8.0.146. After updating to this version, passwords will be stored in an encrypted format once job configurations are saved again. Organizations should upgrade to the fixed version to protect against potential credential exposure (Jenkins Advisory).