{"id":"CVE-2019-10354","aliases":["EUVD-2022-2814","GHSA-6jfc-mc97-c7wg","RHSA-2019:2503","RHSA-2019:2548"],"status":"published","title":"Missing Authorization in Jenkins","description":"A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01617,"percentile":0.76198,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-425","CWE-862"],"published":"2019-07-17T15:45:13Z","modified":"2026-10-24T10:30:55Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","fixed_in":["2.176.2","2.186"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.kohsuke.stapler:stapler-parent","fixed_in":["1.257.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.176.1"},{"fixed":"2.176.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.177"},{"last_affected":"2.185"},{"fixed":"2.186"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.kohsuke.stapler:stapler-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.257.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.176.2"}]}],"versions":["1.396","1.397","1.398","1.399","1.400","1.401","1.403","1.404","1.405","1.406","1.407","1.408","1.409","1.409.1","1.409.2","1.409.3","1.410","1.411","1.412","1.413","1.414","1.415","1.416","1.417","1.418","1.419","1.420","1.421","1.422","1.423","1.424","1.424.1","1.424.2","1.424.3","1.424.4","1.424.5","1.424.6","1.425","1.426","1.427","1.428","1.429","1.430","1.431","1.432","1.433","1.434","1.435","1.436","1.437","1.438","1.439","1.440","1.441","1.442","1.443","1.444","1.445","1.446","1.447","1.447.1","1.447.2","1.448","1.449","1.450","1.451","1.452","1.453","1.454","1.455","1.456","1.457","1.458","1.459","1.460","1.461","1.462","1.463","1.464","1.465","1.466","1.466.1","1.466.2","1.467","1.468","1.469","1.470","1.471","1.472","1.473","1.474","1.475","1.476","1.477","1.478","1.479","1.480","1.480.1","1.480.2","1.480.3","1.481","1.482","1.483","1.484","1.485","1.486","1.487","1.488","1.489","1.490","1.491","1.492","1.493","1.494","1.495","1.496","1.497","1.498","1.499","1.500","1.501","1.502","1.503","1.504","1.505","1.506","1.507","1.508","1.509","1.509.1","1.509.2","1.509.2.JENKINS-14362-jzlib","1.509.2.JENKINS-8856-diag","1.509.3","1.509.3.JENKINS-14362-jzlib","1.509.4","1.510","1.511","1.512","1.513","1.514","1.515","1.516","1.516.JENKINS-14362-jzlib","1.517","1.518","1.518.JENKINS-14362-jzlib","1.519","1.520","1.521","1.522","1.523","1.524","1.525","1.526","1.527","1.528","1.529","1.530","1.531","1.532","1.532.1","1.532.1.JENKINS-19453","1.532.2","1.532.2.JENKINS-21622-diag","1.532.2.JENKINS-22395-diag","1.532.3","1.532.3.JENKINS-22395","1.532.3.JENKINS-22395-2","1.533","1.534","1.535","1.536","1.537","1.538","1.539","1.540","1.541","1.542","1.543","1.544","1.545","1.546","1.547","1.548","1.549","1.550","1.551","1.552","1.553","1.554","1.554.1","1.554.2","1.554.3","1.554.3.JENKINS-18065-ALLRM-all","1.554.3.JENKINS-18065-JENKINS-23945","1.555","1.556","1.557","1.558","1.559","1.560","1.561","1.562","1.563","1.564","1.565","1.565.1","1.565.1.JENKINS-22395-dropLinks","1.565.2","1.565.3","1.566","1.567","1.568","1.569","1.570","1.571","1.572","1.573","1.574","1.575","1.576","1.577","1.578","1.579","1.580","1.580.1","1.580.2","1.580.3","1.581","1.582","1.583","1.584","1.585","1.586","1.587","1.588","1.589","1.590","1.591","1.592","1.593","1.594","1.595","1.596","1.596.1","1.596.2","1.596.3","1.597","1.598","1.599","1.600","1.601","1.602","1.604","1.605","1.606","1.607","1.608","1.609","1.609.1","1.609.2","1.609.3","1.610","1.611","1.612","1.613","1.614","1.615","1.616","1.617","1.618","1.619","1.620","1.621","1.622","1.623","1.624","1.625","1.625.1","1.625.2","1.625.3","1.626","1.627","1.628","1.629","1.630","1.631","1.632","1.633","1.634","1.635","1.636","1.637","1.638","1.639","1.640","1.641","1.642","1.642.1","1.642.2","1.642.3","1.642.4","1.643","1.644","1.645","1.646","1.647","1.648","1.649","1.650","1.651","1.651.1","1.651.2","1.651.3","1.652","1.653","1.654","1.655","1.656","1.657","1.658","2.0","2.0-alpha-1","2.0-alpha-2","2.0-alpha-3","2.0-alpha-4","2.0-beta-1","2.0-beta-2","2.0-rc-1","2.1","2.10","2.100","2.101","2.102","2.103","2.104","2.105","2.106","2.107","2.107.1","2.107.2","2.107.3","2.108","2.109","2.11","2.110","2.111","2.112","2.113","2.114","2.115","2.116","2.117","2.118","2.119","2.12","2.120","2.121","2.121.1","2.121.2","2.121.3","2.122","2.123","2.124","2.125","2.126","2.127","2.128","2.129","2.13","2.130","2.131","2.132","2.133","2.134","2.135","2.136","2.137","2.138","2.138.1","2.138.2","2.138.3","2.138.4","2.14","2.140","2.141","2.142","2.143","2.144","2.145","2.146","2.147","2.148","2.149","2.15","2.150","2.150.1","2.150.2","2.150.3","2.151","2.152","2.153","2.154","2.155","2.156","2.157","2.158","2.159","2.16","2.160","2.161","2.162","2.163","2.164","2.164.1","2.164.2","2.164.3","2.165","2.166","2.167","2.168","2.169","2.17","2.170","2.171","2.172","2.173","2.174","2.175","2.176","2.176.1","2.18","2.19","2.19.1","2.19.2","2.19.3","2.19.4","2.2","2.20","2.21","2.22","2.23","2.24","2.25","2.26","2.27","2.28","2.29","2.3","2.30","2.31","2.32","2.32.1","2.32.2","2.32.3","2.33","2.34","2.35","2.36","2.37","2.38","2.39","2.4","2.40","2.41","2.42","2.43","2.44","2.45","2.46","2.46.1","2.46.2","2.46.3","2.47","2.48","2.49","2.5","2.50","2.51","2.52","2.53","2.54","2.55","2.56","2.57","2.58","2.59","2.6","2.60","2.60.1","2.60.2","2.60.3","2.61","2.62","2.63","2.64","2.65","2.66","2.67","2.68","2.69","2.7","2.7.1","2.7.2","2.7.3","2.7.4","2.70","2.71","2.72","2.73","2.73.1","2.73.2","2.73.3","2.74","2.75","2.76","2.77","2.78","2.79","2.8","2.80","2.81","2.82","2.83","2.84","2.85","2.86","2.87","2.88","2.89","2.89.1","2.89.2","2.89.3","2.89.4","2.9","2.90","2.91","2.92","2.93","2.94","2.95","2.96","2.97","2.98","2.99"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.177"},{"fixed":"2.186"}]}],"versions":["2.177","2.178","2.179","2.180","2.181","2.182","2.183","2.184","2.185"]},{"source":"osv","ecosystem":"Maven","package":"org.kohsuke.stapler:stapler-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.257.1"}]}],"versions":["1.100","1.101","1.102","1.103","1.104","1.105","1.106","1.107","1.108","1.109","1.110","1.111","1.112","1.113","1.114","1.115","1.116","1.117","1.118","1.119","1.120","1.121","1.122","1.123","1.124","1.125","1.126","1.127","1.128","1.129","1.130","1.131","1.132","1.133","1.134","1.135","1.136","1.137","1.138","1.139","1.140","1.141","1.142","1.143","1.144","1.145","1.146","1.147","1.148","1.149","1.150","1.151","1.152","1.153","1.154","1.155","1.156","1.157","1.158","1.159","1.160","1.161","1.162","1.163","1.164","1.165","1.166","1.167","1.168","1.169","1.170","1.171","1.172","1.173","1.174","1.175","1.176","1.177","1.178","1.179","1.180","1.181","1.182","1.183","1.184","1.185","1.186","1.187","1.188","1.189","1.190","1.191","1.192","1.193","1.194","1.195","1.196","1.197","1.198","1.199","1.200","1.201","1.202","1.203","1.204","1.205","1.206","1.207","1.209","1.211","1.212","1.213","1.214","1.216","1.217","1.218","1.219","1.220","1.221","1.222","1.223","1.224","1.225","1.226","1.227","1.228","1.229","1.230","1.231","1.233","1.234","1.236","1.237","1.238","1.239","1.240","1.241","1.242","1.243","1.244","1.246","1.247","1.248","1.249","1.250","1.250.1","1.250.2","1.251","1.252","1.253","1.254","1.254.1","1.254.2","1.254.3","1.255","1.256","1.256.1","1.256.2","1.257","1.97","1.98","1.99"]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.176.2.1563460897-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.176.2.1563461785-1.el7"}]}],"bundled":3}],"products":[{"vendor":"jenkins","product":"jenkins"},{"vendor":"jenkins project","product":"jenkins"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/07/17/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/109373","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2503","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2548","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10354","tags":["advisory"]},{"url":"https://github.com/jenkinsci/jenkins/commit/279d8109eddb7a494428baf25af9756c2e33576b","tags":["web"]},{"url":"https://github.com/jenkinsci/stapler/commit/19637555a9f32d3875356b47234131d8b1e9fee4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6jfc-mc97-c7wg"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730869","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730877","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2503.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10352","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-07-17/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10353","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10353","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10353","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10354","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10354","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2548.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-10354","description":"A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.","status":"published","published":"2019-07-17T15:45:13Z","modified":"2024-08-04T22:17:20.331Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2022-2814","description":"A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.","status":"published","published":"2019-07-17T15:45:13Z","modified":"2024-08-04T22:17:20Z","updated_at":"2026-11-03T02:40:53.055308Z"}],"ghsa":[{"id":"GHSA-6jfc-mc97-c7wg","title":"Missing Authorization in Jenkins","description":"A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.","status":"published","published":"2022-05-24T16:50:30Z","modified":"2023-12-22T10:42:10Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-425","CWE-862"],"updated_at":"2026-11-02T14:37:28.04129Z"}],"nvd":[{"id":"CVE-2019-10354","description":"A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.","status":"published","published":"2019-07-17T16:15:12.553Z","modified":"2026-06-17T02:10:46.54Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:05:20.616405Z"}],"osv":[{"id":"CVE-2019-10354","description":"A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.","status":"published","published":"2019-07-17T16:15:12.553Z","modified":"2026-10-24T10:30:55.97167254Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-6jfc-mc97-c7wg","title":"Missing Authorization in Jenkins","description":"A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.","status":"published","published":"2022-05-24T16:50:30Z","modified":"2024-02-16T08:15:57.609557Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-425","CWE-862"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"RHSA-2019:2503","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins security update","status":"published","published":"2024-09-16T02:45:58Z","modified":"2025-11-22T11:46:59Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2548","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins security update","status":"published","published":"2024-09-16T02:46:05Z","modified":"2025-11-22T11:47:13Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"}]}}