CVE-2019-10354

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

Published: Jul 17, 2019
Updated: May 9, 2024
CVE: CVE-2019-10354
GHSA: GHSA-6jfc-mc97-c7wg
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

CWE-862
CWE-425

OWASP TOP 10:

A5 - Broken Access Control

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.176.1.x
jenkins / jenkins	-	2.185.x
redhat / openshift_container_platform	3.11	3.11.x
redhat / openshift_container_platform	4.1	4.1.x
org.jenkins-ci.main / jenkins-core	-	2.176.2
org.jenkins-ci.main / jenkins-core	2.177	2.186

http://www.openwall.com/lists/oss-security/2019/07/17/2
http://www.securityfocus.com/bid/109373
https://access.redhat.com/errata/RHSA-2019:2503
https://access.redhat.com/errata/RHSA-2019:2548
https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534

Vulnerability Database

289,697

CVE-2019-10354