CVEvulnerability
CVE-2019-10354
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-07-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-862
Description
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Affected configurations
• jenkins jenkins (<= 2.176.1)
• jenkins jenkins (<= 2.185)
• redhat openshift container platform 3.11
• redhat openshift container platform 4.1
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- http://www.openwall.com/lists/oss-security/2019/07/17/2 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/109373 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:2503 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2548 Third Party Advisory
- https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/07/17/2 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/109373 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:2503 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2548 Third Party Advisory
- https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534 Vendor Advisory