CVE-2023-6147 Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance

2024-01-0908:08:43

CWE-611

Qualys

www.cve.org

cve-2023-6147

xxe vulnerability

jenkins plugin

qualys policy compliance

security flaw

permission check

connectivity check

qualys cloud services

rouge endpoint

response control

xxe payloads.

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

16.0%

JSON

Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Policy Compliance Connector Jenkins Plugin",
    "vendor": "Qualys,Inc. ",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.6",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.2",
        "status": "affected",
        "version": "1.0.5",
        "versionType": "custom"
      }
    ]
  }
]