CVE-2023-4777

Summary

CVE-2023-4777 is a vulnerability affecting the Qualys Container Scanning Connector Plugin version 1.6.2.6 and earlier. This issue stems from a misconfigured permission check, enabling attackers with global Item/Configure permissions, but lacking such permissions on specific jobs, to enumerate credentials IDs within Jenkins. By leveraging these IDs, attackers can connect to an attacker-specified URL using the stolen credentials, potentially leading to unauthorized access and data breaches within Jenkins.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.