CVE-2019-10354

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins	2.185 and earlier, LTS 2.176.1 and earlier

References

http://www.openwall.com/lists/oss-security/2019/07/17/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/109373Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2503Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2548Third Party Advisory
https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/07/17/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/109373Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2503Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2548Third Party Advisory
https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534Vendor Advisory

Timeline

Published: Jul 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-103558.8A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to CVE-2019-103568.8A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allo CVE-2019-103574.3A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to ob CVE-2019-103586.5Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build CVE-2019-103596.3A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed CVE-2019-10365.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2019-103605.4A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML an CVE-2019-103615.5Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users wit CVE-2019-103625.4Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import CVE-2019-103634.9Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted CVE-2019-103645.5Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log.CVE-2019-103654.3Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project worksp