CVE-2022-46684
Medium
Description
Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting (XSS) vulnerability.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Jenkins Checkmarx
PublishedDec 12, 2022
First seenDec 12, 2022
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- jenkins checkmarx2022.4.3 or later
- com.checkmarx.jenkins:checkmarx2022.4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jenkins checkmarx | v < 2022.4.3 | 2022.4.3 |
| com.checkmarx.jenkins:checkmarxMaven | v < 2022.4.3 | 2022.4.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.