Description
Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Qualys,Inc. | Web App Scanning Connector Jenkins Plugin | 2.0.11 – ≤ 2.0.3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.qualys.plugins:qualys-was | < 2.0.12 | 2.0.12 | GHSA-5gwh-r76w-934h |
Advisories 1
- WID-SEC-2024-0058 Jenkins Plugin "Qualys Policy Compliance": Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 10, 2024