1. Home
  2. Vulnerabilities
  3. CVE-2023-4777

CVE-2023-4777

CVSS v3.1 4.3 (Medium)
43% Progress
EPSS 0.05 % (22th)
0.05% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Graph Web & Social Timeline

An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins and to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. 

Weaknesses
CWE-732
Incorrect Permission Assignment for Critical Resource
CVE Status
PUBLISHED
CNA
Qualys, Inc.
Published Date
2023-09-08 09:15:08
(12 months ago)
Updated Date
2023-09-13 12:54:59
(12 months ago)

Affected Products

Qualys

Configuration #1

    CPE23 From Up To
  Qualys Container Scanning Connector prior 1.6.2.7 version cpe:2.3:a:qualys:container_scanning_connector < 1.6.2.7