SSL/TLS certificate validation disabled by default in Jenkins Checkmarx Plugin
Summary
CVE-2023-35142: SSL/TLS certificate validation disabled by default in Jenkins Checkmarx Plugin. Affects com.checkmarx.jenkins:checkmarx versions < 2023.2.6. Fixed in 2023.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Checkmarx Plugin is a Maven package (com.checkmarx.jenkins:checkmarx) that integrates Checkmarx, a static application security testing (SAST) tool, with Jenkins, an open-source automation server. This plugin allows developers to scan their code for security vulnerabilities during the build process. It provides a seamless integration between Jenkins and Checkmarx, enabling developers to automate security testing and ensure the quality of their code.
Vulnerability Detail
The Jenkins Checkmarx Plugin version 2022.4.3 and earlier has a vulnerability where SSL/TLS certificate validation is disabled by default for connections to the Checkmarx server. This means that the plugin does not verify the authenticity of the server's SSL/TLS certificate, making it susceptible to man-in-the-middle attacks. An attacker could potentially intercept the communication between the plugin and the Checkmarx server, leading to unauthorized access, data leakage, or other security breaches. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 2025.4.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2023.2.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, users can manually enable SSL/TLS certificate validation in the plugin configuration settings. This can be done by navigating to the Jenkins administration panel, locating the Checkmarx Plugin configuration, and enabling the SSL/TLS certificate validation option.
Conclusion
The SSL/TLS certificate validation vulnerability in the Jenkins Checkmarx Plugin poses a significant security risk to Jenkins installations using affected versions. It is crucial to upgrade to the latest version of the plugin (2023.2.6 or later) to ensure SSL/TLS certificate validation is enabled by default. Additionally, users should follow best practices for securing their Jenkins installations and consider using Vulert Playground (https://vulert.com/scanner) to monitor and detect open-source vulnerabilities in their software.
See every vulnerability recorded for com.checkmarx.jenkins:checkmarx →
FAQ
The vulnerability allows an attacker to intercept the communication between the Jenkins Checkmarx Plugin and the Checkmarx server. This can lead to unauthorized access, data leakage, or other security breaches.
You can use Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
There are no known exploits for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate the risk.
Yes, you can manually enable SSL/TLS certificate validation in the Jenkins Checkmarx Plugin configuration settings. This is a recommended best practice to enhance the security of your Jenkins installation.
While the Jenkins Checkmarx Plugin is a popular choice for integrating Checkmarx with Jenkins, there may be alternative plugins or tools available. It is recommended to explore other options based on your specific requirements and consult with your development team or security experts.
Related vulnerabilities
Recent vulnerabilities recorded for com.checkmarx.jenkins:checkmarx.
