GHSA-wwf6-x2rv-vxqh

Suggest an improvement
Source
https://github.com/advisories/GHSA-wwf6-x2rv-vxqh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-wwf6-x2rv-vxqh/GHSA-wwf6-x2rv-vxqh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wwf6-x2rv-vxqh
Aliases
  • CVE-2022-25201
Published
2022-02-16T00:01:19Z
Modified
2023-11-08T04:08:43.699982Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Missing permission checks in Jenkins Checkmarx Plugin allow capturing credentials
Details

Checkmarx Plugin 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

References

Affected packages

Maven / com.checkmarx.jenkins:checkmarx

Package

Name
com.checkmarx.jenkins:checkmarx
View open source insights on deps.dev
Purl
pkg:maven/com.checkmarx.jenkins/checkmarx

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2022.1.3

Affected versions

7.*

7.5.0

8.*

8.0.0
8.0.1
8.1.0
8.1.0-1
8.1.0-2
8.2.0
8.5.0
8.41.0
8.42.0
8.50.0
8.60.0
8.60.1
8.70.0
8.80.0
8.80.3
8.90.1
8.90.3
8.90.4

2020.*

2020.2.20
2020.3.3
2020.4.3
2020.4.8

2021.*

2021.1.2
2021.2.94
2021.2.96
2021.3.1
2021.3.3
2021.4.1
2021.4.2
2021.4.3

2022.*

2022.1.2