GHSA-6jfc-mc97-c7wg
Missing Authorization in Jenkins
At a glance
- Published
- Updated
- CVE
- CVE-2019-10354
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 2.176.2 |
| Maven · org.jenkins-ci.main:jenkins-core | introduced 2.177, fixed 2.186 |
| Maven · org.kohsuke.stapler:stapler-parent | introduced 0, fixed 1.257.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10354 ADVISORY
- https://github.com/jenkinsci/jenkins/commit/279d8109eddb7a494428baf25af9756c2e33576b WEB
- https://github.com/jenkinsci/stapler/commit/19637555a9f32d3875356b47234131d8b1e9fee4 WEB
- https://access.redhat.com/errata/RHSA-2019:2503 WEB
- https://access.redhat.com/errata/RHSA-2019:2548 WEB
- https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534 WEB
- http://www.openwall.com/lists/oss-security/2019/07/17/2 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |