AIKIDO-2026-440350
appscan is vulnerable to Missing Authorization
43
CVE Score
Medium
Missing Authorization
TL;DR
Several HTTP endpoints skip permission checks. An attacker with Overall/Read permission can list credentials IDs stored in Jenkins, which can help capture those credentials when combined with another issue. The fix requires appropriate permissions on the affected endpoints.
How do I fix this?
Upgrade the com.hcl.security:appscan library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and users with Overall/Read permission can reach the plugin HTTP endpoints.
Package
Versions
0.0.1 - 1.8.3
Fixed in 1.8.4Background info
appscan is vulnerable to Missing Authorization in versions 0.0.1 - 1.8.3.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.