VULNERABILITY INTELLIGENCE
CVE-2019-10354
CVSS score4.3 MEDIUM
EPSS probability1.65%
CISA KEVNot currently listed
Published2019-07-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Weakness classification
- nvd@nist.gov: CWE-862
Primary references
- jenkinsci-cert@googlegroups.com — Mailing List, Third Party Advisory
- jenkinsci-cert@googlegroups.com — Third Party Advisory, VDB Entry
- jenkinsci-cert@googlegroups.com — Third Party Advisory
- jenkinsci-cert@googlegroups.com — Third Party Advisory
- jenkinsci-cert@googlegroups.com — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory