SSL/TLS certificate validation disabled by default in Jenkins Checkmarx Plugin

ALTO 8.1CVE-2023-35142 · GHSA-rr3p-5fcf-v5m3 · Published 14/06/2023 · updated 17/06/2026

En resumen

CVE-2023-35142 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a com.checkmarx.jenkins:checkmarx, checkmarx (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.78%, mayor que el 55.8% de las vulnerabilidades.
Solución: actualizar a 2023.2.6 o posterior.

Package	Affected versions	Patched versions
com.checkmarx.jenkins:checkmarx Maven	`< 2023.2.6`	`2023.2.6`
checkmarx jenkins	`≤ 2023.4.3`	No fix yet

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.

NVD description

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

< 2023.2.6

2023.2.6

≤ 2023.4.3

No fix yet

Más vulnerabilidades de com.checkmarx.jenkins:checkmarx

Ver todo →