CVE-2022-46684: Jenkins Checkmarx

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting (XSS) vulnerability.

Affected products

• Jenkins Checkmarx: before 2022.4.3 (fixed in 2022.4.3)

Published 2022-12-12. Last modified 2026-06-17.