Description
Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Qualys,Inc. | Policy Compliance Connector Jenkins Plugin | 1.0.5 – ≤ 1.0.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.qualys.plugins:qualys-pc | < 1.0.6 | 1.0.6 | GHSA-8525-52vg-jv6v |
Advisories 2
- WID-SEC-2024-0199 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 20, 2024
- WID-SEC-2024-0058 Jenkins Plugin "Qualys Policy Compliance": Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 10, 2024