← CVE Intelligence

CVE-2023-4777

Incorrect Permission Assignment on Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier PUBLISHED

Description (CNA)

An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins and to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. 

Affected (CNA)

Vendor / productVersions
Qualys,Inc. / Container Scanning Connector Jenkins Pluginaffected 1.6.2.6 through 1.6.0.1

CWE

CWE-732

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.