CVE-2023-6147 is a missing permission check vulnerability in the Qualys Jenkins Plugin for Policy Compliance (versions 1.0.5 and earlier). This flaw allows any authenticated user with job configuration privileges to inject XML External Entity (XXE) payloads by configuring a rogue endpoint during a connectivity check to Qualys Cloud Services. The vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity, requiring low privileges, and potentially leading to high impact on integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog. Community discussion and media coverage are minimal, suggesting low current attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.0.5CPE matchmatch criteria | cpe:2.3:a:qualys:policy_compliance:*:*:*:*:*:jenkins:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Qualys Jenkins Plugin for Policy Compliance XML External Entity vulnerability
Jan 9, 2024