CVE-2019-10354
Fixed in a distro release EPSS 2%
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Products: Jenkins project Jenkins
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.176.2 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.186 |
| Maven | org.kohsuke.stapler:stapler-parent | 1.257.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat:openshift:3.11 | jenkins | 0:2.176.2.1563460897-1.el7 |
| Red Hat:openshift:4.1 | jenkins | 0:2.176.2.1563461785-1.el7 |