PT-2023-26811 · Jenkins · Jenkins Qualys Web App Scanning Connector Plugin+1

Yaroslav Afenkin · Published 2023-07-26 · Updated 2023-07-31 · CVE-2023-39154

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Qualys Web App Scanning Connector Plugin versions 2.0.10 and earlier

Description The issue arises from incorrect permission checks in the Jenkins Qualys Web App Scanning Connector Plugin, allowing attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method. This can lead to the capture of credentials stored in Jenkins. The plugin does not correctly perform permission checks in several HTTP endpoints.

Recommendations For Jenkins Qualys Web App Scanning Connector Plugin versions 2.0.10 and earlier, update to version 2.0.11 or later, which requires the appropriate permissions for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-39154

GHSA-8WGF-3MRJ-73X7

Affected Products

Jenkins

Jenkins Qualys Web App Scanning Connector Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-39154 · Security Note
• https://jenkins.io/security/advisory/2023-07-26/#SECURITY-3012 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39154 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8wgf-3mrj-73x7 · Vendor Advisory
• https://t.me/cvenotify/55235 · Telegram Post
• http://openwall.com/lists/oss-security/2023/07/26/2 · Note