Missing permission checks in Jenkins Checkmarx Plugin allow capturing credentials

MEDIO 6.5CVE-2022-25201 · GHSA-wwf6-x2rv-vxqh · Published 15/02/2022 · updated 17/06/2026

En resumen

CVE-2022-25201 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a com.checkmarx.jenkins:checkmarx, checkmarx (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.74%, mayor que el 54.7% de las vulnerabilidades.
Solución: actualizar a 2022.1.3 o posterior.

Package	Affected versions	Patched versions
com.checkmarx.jenkins:checkmarx Maven	`< 2022.1.3`	`2022.1.3`
checkmarx jenkins	`≤ 2022.1.2`	No fix yet

Description

Checkmarx Plugin 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

NVD description

Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

References

nvd.nist.gov/vuln/detail/CVE-2022-25201 · ADVISORY
jenkinsci/checkmarx-plugin · PACKAGE
jenkinsci/checkmarx-plugin release Release_2022.1.3 · WEB
jenkins.io/security/advisory/2022-02-15 · WEB

Más vulnerabilidades de com.checkmarx.jenkins:checkmarx

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.checkmarx.jenkins:checkmarx

Maven

< 2022.1.3

2022.1.3

checkmarx

jenkins

≤ 2022.1.2

No fix yet

Description

Checkmarx Plugin 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints.

NVD description

Más vulnerabilidades de com.checkmarx.jenkins:checkmarx

Ver todo →