CVE-2022-46684: Stored XSS vulnerability in Jenkins Checkmarx Plugin
Summary
CVE-2022-46684: Stored XSS vulnerability in Jenkins Checkmarx Plugin. Affects com.checkmarx.jenkins:checkmarx versions < 2022.4.3. Fixed in 2022.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Checkmarx Plugin is a component of Jenkins, an open-source automation server. It processes Checkmarx service API responses and generates HTML reports for rendering on the Jenkins UI. The Checkmarx Plugin version 2022.3.3 and earlier is susceptible to a stored cross-site scripting (XSS) vulnerability. This vulnerability arises from the failure to properly escape values returned from the Checkmarx service API before inserting them into HTML reports. Although users without Overall/Administer permission cannot configure the URL to the Checkmarx service, the vulnerability can still be exploited through man-in-the-middle attacks. The Checkmarx Plugin version 2022.4.3 addresses this issue by correctly escaping the API values in HTML reports.
Vulnerability Detail
The stored XSS vulnerability in the Checkmarx Plugin allows an attacker to inject malicious code into HTML reports generated by the plugin. This can lead to the execution of arbitrary scripts in the context of the user's browser, potentially compromising the confidentiality and integrity of user data. The vulnerability can be exploited by manipulating the Checkmarx service API responses and bypassing the lack of proper HTML escaping. The impact of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 2025.4.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2022.4.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the Checkmarx Plugin as soon as possible.
Conclusion
The Checkmarx Plugin version 2022.3.3 and earlier is vulnerable to a stored XSS attack, which can be exploited to execute arbitrary scripts in the user's browser. Upgrading to Checkmarx Plugin version 2022.4.3 or later is essential to mitigate this vulnerability. It is recommended to promptly update the plugin to ensure the security and integrity of Jenkins deployments. For further support and assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.checkmarx.jenkins:checkmarx →
FAQ
The Checkmarx Plugin is a component of Jenkins that processes Checkmarx service API responses and generates HTML reports for rendering on the Jenkins UI.
The stored XSS vulnerability in the Checkmarx Plugin allows an attacker to execute arbitrary scripts in the user's browser, potentially compromising data confidentiality and integrity.
While users without Overall/Administer permission cannot configure the URL to the Checkmarx service, the vulnerability can still be exploited through man-in-the-middle attacks.
To fix this vulnerability, users should upgrade to Checkmarx Plugin version 2022.4.3 or later.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the Checkmarx Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for com.checkmarx.jenkins:checkmarx.
