GitHub Advisoryadvisory · Maven

GHSA-8525-52vg-jv6v Qualys Jenkins Plugin for Policy Compliance XML External Entity vulnerability

MEDIUM Published 2024-01-09 Modified 2024-01-12 Official page ↗
Aliases
CVE-2023-6147
Ecosystem
Maven
Packages
com.qualys.plugins:qualys-pc
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2024-01-09

Affected packages

• Maven com.qualys.plugins:qualys-pc: < 1.0.6 → fixed in 1.0.6

Description

Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data

Related

Alias · CVE (1)

  • CVE-2023-6147 Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References