CVE-2023-35142 SSL/TLS certificate validation disabled by default in Jenkins Checkmarx Plugin
The Jenkins Checkmarx Plugin disables SSL/TLS validation by default, allowing attackers to intercept or manipulate traffic between Jenkins and the Checkmarx server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-35142?
CVE-2023-35142 is a high-severity vulnerability in Jenkins Checkmarx Plugin, published on 14 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.
Weakness: CWE-295
Which versions are affected by CVE-2023-35142?
2 open source packages ship an affected version, including com.checkmarx.jenkins:checkmarx. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.checkmarx.jenkins:checkmarx Maven | All versions | 2023.2.6 |
com.checkmarx.jenkins:checkmarx Maven | All versions | 2023.2.6 |
Products include Jenkins Checkmarx.
How do I fix CVE-2023-35142?
Upgrade com.checkmarx.jenkins:checkmarx to 2023.2.6 or later.
Is CVE-2023-35142 being exploited?
There is no known exploitation of CVE-2023-35142 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Checkmarx Plugin
Sources
Also known as GHSA-rr3p-5fcf-v5m3.