GHSA-p86x-75j8-w4xh

Suggest an improvement
Source
https://github.com/advisories/GHSA-p86x-75j8-w4xh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-p86x-75j8-w4xh/GHSA-p86x-75j8-w4xh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-p86x-75j8-w4xh
Aliases
  • CVE-2022-46684
Published
2022-12-12T09:30:35Z
Modified
2023-11-08T04:10:57.287686Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Stored XSS vulnerability in Jenkins Checkmarx Plugin
Details

heckmarx Plugin processes Checkmarx service API responses and generates HTML reports from them for rendering on the Jenkins UI.

Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports. This results in a stored cross-site scripting (XSS) vulnerability.

While Jenkins users without Overall/Administer permission are not allowed to configure the URL to the Checkmarx service, this could still be exploited via man-in-the-middle attacks.

Checkmarx Plugin 2022.4.3 escapes values returned from the Checkmarx service API before inserting them into HTML reports.

Database specific 
{
    "nvd_published_at": "2022-12-12T09:15:00Z",
    "github_reviewed_at": "2022-12-16T23:00:52Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Maven / com.checkmarx.jenkins:checkmarx

Package

Name
com.checkmarx.jenkins:checkmarx
View open source insights on deps.dev
Purl
pkg:maven/com.checkmarx.jenkins/checkmarx

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2022.4.3

Affected versions

7.*

7.5.0

8.*

8.0.0
8.0.1
8.1.0
8.1.0-1
8.1.0-2
8.2.0
8.5.0
8.41.0
8.42.0
8.50.0
8.60.0
8.60.1
8.70.0
8.80.0
8.80.3
8.90.1
8.90.3
8.90.4

2020.*

2020.2.20
2020.3.3
2020.4.3
2020.4.8

2021.*

2021.1.2
2021.2.94
2021.2.96
2021.3.1
2021.3.3
2021.4.1
2021.4.2
2021.4.3

2022.*

2022.1.2
2022.1.3
2022.2.1
2022.2.3
2022.3.2
2022.3.3

Database specific 

{
    "last_known_affected_version_range": "<= 2022.3.3"
}