CVE-2023-6147
Medium
Description
Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data
SeverityMedium
CVSS5.7
Exploit probability—
ProductQualys Policy Compliance
PublishedJan 9, 2024
First seenJan 9, 2024
Weakness typeCWE-611XML external entity (XXE)
How to fix
Update
- com.qualys.plugins:qualys-pc1.0.6 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qualys policy_compliance | v ≤ 1.0.5 | — |
| com.qualys.plugins:qualys-pcMaven | v < 1.0.6 | 1.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.