CVE-2023-4777

Name of the Vulnerable Software and Affected Versions Qualys Container Scanning Connector Plugin versions 1.6.2.6 and earlier

Description An incorrect permission check in the Qualys Container Scanning Connector Plugin allows attackers with global Item/Configure permission, but lacking Item/Configure permission on any particular job, to enumerate credentials IDs of credentials stored in Jenkins and to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins.

Recommendations For Qualys Container Scanning Connector Plugin versions 1.6.2.6 and earlier, consider updating to a version that includes the necessary permission checks to prevent exploitation. As a temporary workaround, restrict access to the global Item/Configure permission to minimize the risk of credentials enumeration and capture. Additionally, limit the ability to connect to external URLs using stored credentials IDs until a patch is available.