{"id":"CVE-2019-10357","aliases":["EUVD-2022-3461","GHSA-9x5v-8352-244g","RHSA-2019:2651","RHSA-2019:2662"],"status":"published","title":"Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin","description":"A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01213,"percentile":0.68734,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-862"],"published":"2019-07-31T12:45:21Z","modified":"2026-10-24T10:30:18Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins.workflow:workflow-cps-global-lib","fixed_in":["2.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins.workflow:workflow-cps-global-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14"},{"fixed":"2.15"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins.workflow:workflow-cps-global-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15"}]}],"versions":["0.1-beta-5","0.1-beta-6","0.1-beta-7","0.1-beta-8","1.0","1.0-beta-1","1.1","1.10","1.10-beta-1","1.10.1","1.11","1.11-beta-1","1.11-beta-2","1.11-beta-3","1.11-beta-4","1.12","1.12-beta-1","1.12-beta-2","1.12-beta-3","1.13","1.14","1.14-beta-1","1.14.1","1.14.1-beta-1","1.14.2","1.15","1.15-beta-1","1.2","1.3","1.4","1.4.1","1.4.2","1.4.3","1.4.3-beta-1","1.5","1.6","1.6-alpha-1","1.7","1.7-alpha-1","1.8","1.9","1.9-beta-1","2.0","2.1","2.10","2.11","2.12","2.12.1","2.13","2.13.1","2.14","2.2","2.3","2.4","2.5","2.6","2.7","2.8","2.9"]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1566492396-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1567707934-1.el7"}]}],"bundled":3}],"products":[{"vendor":"jenkins","product":"pipeline\\"},{"vendor":"jenkins project","product":"jenkins pipeline: shared groovy libraries plugin"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/07/31/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2651","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2594","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2662","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://jenkins.io/security/advisory/2019-07-31/#SECURITY1422","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10357","tags":["advisory"]},{"url":"https://github.com/jenkinsci/workflow-cps-global-lib-plugin/commit/6fce1e241d82641e8648c546bc63c22a5e07e96b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9x5v-8352-244g"},{"url":"https://github.com/jenkinsci/workflow-cps-global-lib-plugin","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735521","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2651.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10355","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10355","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10355","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(1)","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10356","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(2)","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10357","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10357","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1422","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2662.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-10357","description":"A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.","status":"published","published":"2019-07-31T12:45:21Z","modified":"2024-08-04T22:17:20.501Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2022-3461","description":"A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.","status":"published","published":"2019-07-31T12:45:21Z","modified":"2024-08-04T22:17:20Z","updated_at":"2026-11-03T02:40:53.055308Z"}],"ghsa":[{"id":"GHSA-9x5v-8352-244g","title":"Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin","description":"A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.","status":"published","published":"2022-05-24T16:51:50Z","modified":"2023-09-11T20:44:11Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-285","CWE-862"],"updated_at":"2026-11-02T14:37:03.916765Z"}],"nvd":[{"id":"CVE-2019-10357","description":"A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.","status":"published","published":"2019-07-31T13:15:12.557Z","modified":"2026-06-17T02:10:46.897Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-10357","description":"A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.","status":"published","published":"2019-07-31T13:15:12.557Z","modified":"2026-10-24T10:30:18.448946706Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-9x5v-8352-244g","title":"Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin","description":"A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.","status":"published","published":"2022-05-24T16:51:50Z","modified":"2024-02-16T08:06:36.041357Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-285","CWE-862"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"RHSA-2019:2651","title":"Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update","status":"published","published":"2024-09-16T02:51:41Z","modified":"2025-11-22T11:47:36Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2662","title":"Red Hat Security Advisory: Red Hat OpenShift Container Platform 4.1 jenkins-2-plugins security update","status":"published","published":"2024-09-16T02:51:46Z","modified":"2025-11-22T11:47:39Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"}]}}