Not rated

CVE-2023-39154 Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers…

Description

Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Qualys Web App Scanning Connector Plugin 2.0	earliest → 2.0.10	No fix stated

Do you use Jenkins Qualys Web App Scanning Connector Plugin?

Track this CVE Watch Jenkins Qualys Web App Scanning Connector Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2023-39154

Timeline

Published July 26, 2023
Last modified October 23, 2024

References

Jenkins Security Advisory 2023-07-26 www.jenkins.io
www.openwall.com www.openwall.com

Track this CVE