CVE-2023-6147
Assigner: Qualys
Published: 2024-01-09T08:08:43.883Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Policy Compliance Connector Jenkins Plugin
vendor: Qualys,Inc. 
versions: changes: at: 1.0.6
status: unaffected
lessThanOrEqual: 1.0.2
status: affected
version: 1.0.5
versionType: custom
credits: type: reporter
user: 00000000-0000-4000-9000-000000000000
value: Yaroslav Afenkin, CloudBees, Inc. 
datePublic: 2024-01-09T08:05:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data</span>
value: 
Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-611
description: CWE-611
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Customers should upgrade to a minimum version of 1.0.6.</span><span style="background-color: rgb(255, 255, 255);">&nbsp;</span>

<br>
value: 
Customers should upgrade to a minimum version of 1.0.6. 



source: discovery: UNKNOWN
title: Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance 
x_generator: engine: Vulnogram 0.1.0-dev