GitHub Advisoryadvisory · Maven

GHSA-5gwh-r76w-934h Qualys Jenkins Plugin for WAS XML External Entity vulnerability

MEDIUM Published 2024-01-09 Modified 2024-01-09 Official page ↗
Aliases
CVE-2023-6149
Ecosystem
Maven
Packages
com.qualys.plugins:qualys-was
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2024-01-09

Affected packages

• Maven com.qualys.plugins:qualys-was: < 2.0.12 → fixed in 2.0.12

Description

Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data

Related

Alias · CVE (1)

  • CVE-2023-6149 Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References