GitHub Advisoryadvisory · Maven

GHSA-6jfc-mc97-c7wg Missing Authorization in Jenkins

MEDIUM Published 2022-05-24 Modified 2022-06-28 Official page ↗
Aliases
CVE-2019-10354
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core, org.kohsuke.stapler:stapler-parent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-425, CWE-862
Reviewed
2022-06-28

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.176.2 → fixed in 2.176.2 • Maven org.jenkins-ci.main:jenkins-core: >= 2.177, < 2.186 → fixed in 2.186 • Maven org.kohsuke.stapler:stapler-parent: < 1.257.1 → fixed in 1.257.1

Description

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

Related

Alias · CVE (1)

  • CVE-2019-10354 A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view… vulnerability

Weakness · CWE (2)

  • CWE-425 Direct Request weakness
  • CWE-862 Missing Authorization weakness

References