CVE-2019-10354
Missing Authorization in Jenkins
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
- Record
CVE-2019-10354- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
- Record
CVE-2019-10354- Updated
- 2026-11-02
EUVDEUVD-2022-2814 No score
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
- Record
EUVD-2022-2814- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6jfc-mc97-c7wg
Missing Authorization in Jenkins
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
- Record
GHSA-6jfc-mc97-c7wg- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-425, CWE-862
- Updated
- 2026-11-02
OSV
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
- Record
CVE-2019-10354- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-6jfc-mc97-c7wg
Missing Authorization in Jenkins
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
- Record
GHSA-6jfc-mc97-c7wg- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-425, CWE-862
- Updated
- 2026-11-02
OSVRHSA-2019:2503
Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins security update
- Record
RHSA-2019:2503- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2019:2548
Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins security update
- Record
RHSA-2019:2548- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
through 2.176.1 | 2.176.2 |
org.jenkins-ci.main:jenkins-coreMaven |
2.177 to 2.185 | 2.186 |
org.kohsuke.stapler:stapler-parentMaven |
before 1.257.1 | 1.257.1 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.176.2, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.176.2 |
org.jenkins-ci.main:jenkins-coreMaven |
2.177 up to 2.186, plus listed versions 2.1782.1792.1802.1812.1822.1832.1842.185 |
2.186 |
org.kohsuke.stapler:stapler-parentMaven |
before 1.257.1, plus listed versions 1.1001.1011.1021.1031.104 Show 45 moreShow less1.1051.1061.1071.1081.1091.1101.1111.1121.1131.1141.1151.1161.1171.1181.1191.1201.1211.1221.1231.1241.1251.1261.1271.1281.1291.1301.1311.1321.1331.1341.1351.1361.1371.1381.1391.1401.1411.1421.1431.1441.1451.1461.1471.1481.149 |
1.257.1 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:2.176.2.1563460897-1.el7 | 0:2.176.2.1563460897-1.el7 |
jenkinsRed Hat:openshift:4.1::el7 From an advisory covering 3 CVEs |
before 0:2.176.2.1563461785-1.el7 | 0:2.176.2.1563461785-1.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10354 is a medium vulnerability (CVSS 4.3) in Jenkins, published July 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.62%, the 76th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.176.2.
References
openwall.com/lists/oss-security/2019/07/17/2
securityfocus.com/bid/109373
access.redhat.com/errata/RHSA-2019:2503
jenkins.io/security/advisory/2019-07-17
nvd.nist.gov/vuln/detail/CVE-2019-10354
Show 17 moreShow less
github.com/jenkinsci/jenkins/commit/279d8109eddb7a494428baf25af9756c2e33576b
bugzilla.redhat.com/show_bug.cgi?id=1730824
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2503.json
cve.org/CVERecord?id=CVE-2019-10352
Left out here: 608 versions. The JSON record has them.