CVE-2023-6148: 
Java vulnerability analysis and mitigation

Qualys Jenkins Plugin for Policy Compliance versions up to and including 1.0.5 contains a security vulnerability identified as CVE-2023-6148. The vulnerability was discovered and disclosed on January 9, 2024, affecting the plugin's connectivity check functionality to Qualys Cloud Services (Qualys Advisory, NVD).

The vulnerability stems from a missing permission check during connectivity verification with Qualys Cloud Services. The flaw allows users with login access and job configuration permissions to configure a rogue endpoint that can control responses for certain requests. These responses could be injected with XSS (Cross-Site Scripting) payloads, leading to XSS vulnerabilities when processing the response data. The vulnerability has been assigned a CVSS v3.1 base score of 5.7 (Medium) by Qualys and 5.4 (Medium) by NVD (Qualys Advisory).

The vulnerability enables attackers with login access and job configuration permissions to execute cross-site scripting (XSS) attacks through the plugin's response processing mechanism. This could potentially lead to unauthorized access to sensitive information or execution of malicious code in the context of other users' sessions (OSS Security).

Exploitation of this vulnerability requires the attacker to have both login access to Jenkins and permissions to configure or edit jobs. The attacker must be able to manipulate the plugin to configure a rogue endpoint that can inject XSS payloads into responses (Qualys Advisory).

The vulnerability has been patched in version 1.0.6 of the Qualys Jenkins Plugin for Policy Compliance. Users are strongly advised to upgrade to this version or later to address the security issue (Qualys Advisory).