GHSA-5pcf-vxm3-frphMediumCVSS 4.2

CSRF vulnerability in Jenkins Checkmarx Plugin allow capturing credentials

Published
February 16, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-25200 →

📋 Description

Checkmarx Plugin 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

🎯 Affected products1

  • maven/com.checkmarx.jenkins:checkmarx:< 2022.1.3

🔗 References (5)