GHSA-5pcf-vxm3-frph

Suggest an improvement
Source
https://github.com/advisories/GHSA-5pcf-vxm3-frph
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-5pcf-vxm3-frph/GHSA-5pcf-vxm3-frph.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5pcf-vxm3-frph
Aliases
  • CVE-2022-25200
Published
2022-02-16T00:01:20Z
Modified
2023-11-08T04:08:43.638087Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
CSRF vulnerability in Jenkins Checkmarx Plugin allow capturing credentials
Details

Checkmarx Plugin 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-01T22:24:53Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "MODERATE",
    "nvd_published_at": "2022-02-15T17:15:00Z"
}
References

Affected packages

Maven / com.checkmarx.jenkins:checkmarx

Package

Name
com.checkmarx.jenkins:checkmarx
View open source insights on deps.dev
Purl
pkg:maven/com.checkmarx.jenkins/checkmarx

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2022.1.3

Affected versions

7.*

7.5.0

8.*

8.0.0
8.0.1
8.1.0
8.1.0-1
8.1.0-2
8.2.0
8.5.0
8.41.0
8.42.0
8.50.0
8.60.0
8.60.1
8.70.0
8.80.0
8.80.3
8.90.1
8.90.3
8.90.4

2020.*

2020.2.20
2020.3.3
2020.4.3
2020.4.8

2021.*

2021.1.2
2021.2.94
2021.2.96
2021.3.1
2021.3.3
2021.4.1
2021.4.2
2021.4.3

2022.*

2022.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-5pcf-vxm3-frph/GHSA-5pcf-vxm3-frph.json"