CVE-2023-4777

Low

Description

An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins and to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins.

SeverityLow

CVSS3.1

Exploit probability—

ProductQualys Container Scanning Connector

PublishedSep 8, 2023

First seenSep 8, 2023

Weakness typeCWE-732CWE-732

How to fix

Update

qualys container_scanning_connector1.6.2.7 or later

Vendor advisories

qualys.com/security-advisories/

Affected products

Product	Affected versions	Fixed in
qualys container_scanning_connector	v < 1.6.2.7	1.6.2.7

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.