Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen im Jenkins plugin "Qualys Policy Compliance" ausnutzen, um Dateien zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuführen.
Product
Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.
Vulnerabilities 3
-
Medium 5.7
Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance
Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with …
-
Medium 5.7
Possible XSS vulnerability in Jenkins Plugin for Qualys Policy Compliance
Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with …
-
Medium 5.7
Possible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security
Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access …
Revision history
-
#1
Initiale Fassung
References
-
Qualys Vulnerability Disclosure vom 2024-01-10
https://www.qualys.com/security-advisories/cve-2023-6147/
-
Qualys Vulnerability Disclosure vom 2024-01-10
https://www.qualys.com/security-advisories/cve-2023-6148/
-
Qualys Vulnerability Disclosure vom 2024-01-10
https://www.qualys.com/security-advisories/cve-2023-6149/