GHSA-wwf6-x2rv-vxqhMediumCVSS 4.2

Missing permission checks in Jenkins Checkmarx Plugin allow capturing credentials

Published
February 16, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-25201 →

📋 Description

Checkmarx Plugin 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

🎯 Affected products1

  • maven/com.checkmarx.jenkins:checkmarx:< 2022.1.3

🔗 References (4)