CVE-2023-6148 is a cross-site scripting (XSS) vulnerability affecting the Qualys Jenkins Plugin for Policy Compliance versions up to and including 1.0.5. The flaw stems from a missing permission check during connectivity tests, allowing authenticated users with job configuration access to inject XSS payloads through a rogue endpoint. Rated Medium (CVSS 5.4), successful exploitation could lead to information disclosure and integrity issues. There is currently no public exploit code available, it is not listed in CISA's KEV catalog, and community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.0.5CPE matchmatch criteria | cpe:2.3:a:qualys:policy_compliance:*:*:*:*:*:jenkins:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Possible XSS vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Possible XSS vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Possible XSS vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Possible XSS vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Possible XSS vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Possible XSS vulnerability in Jenkins Plugin for Qualys Policy Compliance
Jan 10, 2024Qualys Jenkins Plugin for Policy Compliance Cross-site Scripting vulnerability
Jan 9, 2024