CVE-2023-39154
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The Qualys Web App Scanning Connector plugin for Jenkins, version 2.0.10 and earlier, has incorrect permission checks that allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credential IDs obtained through another method.
Risk Assessment
Attackers may gain access to credentials stored in Jenkins, potentially leading to further attacks on the organization's systems.
Recommendation
It is recommended to update the plugin to the latest version and review user permissions to restrict access to critical functions.
Original NVD description (English source)
Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.