Jenkins Checkmarx vulnerabilities

4 CVEs affecting Jenkins Checkmarx, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-35142, published 2023-06-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-35142, published 2023-06-14. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.
CVE-2022-25201, published 2022-02-15. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified…
CVE-2022-25200, published 2022-02-15. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials…
CVE-2022-46684, published 2022-12-12. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting (XSS)…