title: Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance
description:
Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data
problem types: CWE-611
affected:
{
defaultStatus: unaffected
product: Policy Compliance Connector Jenkins Plugin
vendor: Qualys,Inc.
versions:
changes: [at: 1.0.6, status: unaffected], lessThanOrEqual: 1.0.2, status: affected, version: 1.0.5, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Customers should upgrade to a minimum version of 1.0.6.