description: Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
affected:
{
defaultStatus: unaffected
product: Jenkins Qualys Web App Scanning Connector Plugin
vendor: Jenkins Project
versions:
lessThanOrEqual: 2.0.10, status: affected, version: 0, versionType: maven
}