Lucene search

[email protected]CVE-2019-10354

HistoryJul 17, 2019 - 4:15 p.m.

CVE-2019-10354

2019-07-1716:15:12

CWE-862

[email protected]

web.nvd.nist.gov

cve-2019-10354

vulnerability

stapler web framework

jenkins

access

bypass

permission check

sensitive information

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.3 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.2%

JSON

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

Affected configurations

NVD

Node

jenkinsjenkinsRange≤2.176.1lts

jenkinsjenkinsRange≤2.185-

Node

redhatopenshift_container_platformMatch3.11

redhatopenshift_container_platformMatch4.1

CPENameOperatorVersion
jenkins:jenkinsjenkinsle2.176.1
jenkins:jenkinsjenkinsle2.185

CPE	Name	Operator	Version
jenkins:jenkins	jenkins	le	2.176.1
jenkins:jenkins	jenkins	le	2.185

CNA Affected

[
  {
    "product": "Jenkins",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "2.185 and earlier, LTS 2.176.1 and earlier"
      }
    ]
  }
]