title: Incorrect Permission Assignment on Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier
description:
An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins and to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins.
problem types: CWE-732 Incorrect Permission Assignment for Critical Resource
affected:
{
defaultStatus: unaffected
product: Container Scanning Connector Jenkins Plugin
vendor: Qualys,Inc.
versions:
lessThanOrEqual: 1.6.0.1, status: affected, version: 1.6.2.6, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Customers should upgrade to a minimum version of 1.6.2.7.