{"id":"CVE-2019-10354","published":"2019-07-17T15:45:13Z","modified":"2024-08-04T22:17:20Z","title":"A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed…","vendor":"Jenkins","product":"Jenkins","tier":"tail","description":{"text":"A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01647,"percentile":0.76377,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/07/17/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.securityfocus.com/bid/109373","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2503","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2548","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534","tags":["x_refsource_CONFIRM"]}],"priority":{"score":15.3,"factors":[{"name":"EPSS percentile","points":15.28}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins","versions":["2.185 and earlier, LTS 2.176.1 and earlier"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":["<2.176.2",">=2.177, <2.186"],"patched":["2.176.2","2.186"],"from":["GHSA-6jfc-mc97-c7wg"],"provenance":"source"},{"ecosystem":"Maven","package":"org.kohsuke.stapler:stapler-parent","vulnerableRanges":["<1.257.1"],"patched":["1.257.1"],"from":["GHSA-6jfc-mc97-c7wg"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2814","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-jenkins-cve-2013-0158","parents":[{"from":"CVE-2018-1000997","to":"CVE-2019-10354","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.kohsuke.stapler:stapler-parent","fromFixed":"1.250.2","toFixed":"1.257.1","daysApart":175},{"kind":"same-code","provenance":"machine","files":["core/src/main/java/org/kohsuke/stapler/Facet.java","groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java","jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java"],"commits":["https://github.com/jenkinsci/stapler/commit/0dfc28aa2102a59638484fc11c4c53b1dbb2baf0","https://github.com/jenkinsci/stapler/commit/19637555a9f32d3875356b47234131d8b1e9fee4"],"basis":"shared function","functions":["createRequestDispatcher","discoverExtensions"]}]},{"from":"CVE-2013-0158","to":"CVE-2019-10354","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/jenkins/model/Jenkins.java"],"commits":["https://github.com/jenkinsci/jenkins/commit/3dc13b957b14cec649036e8dd517f0f9cb21fb04","https://github.com/jenkinsci/jenkins/commit/c3d8e05a1b3d58b6c4dcff97394cb3a79608b4b2","https://github.com/jenkinsci/jenkins/commit/279d8109eddb7a494428baf25af9756c2e33576b"],"basis":"shared function","functions":["Jenkins"]}]}],"packageHistory":[{"cve":"CVE-2019-1003050","published":"2019-04-10","fixed":"2.172","kev":false,"link":{"from":"CVE-2019-1003050","to":"CVE-2019-10354","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.main:jenkins-core","fromFixed":"2.172","toFixed":"2.176.2","daysApart":98}]}},{"cve":"CVE-2019-10352","published":"2019-07-17","fixed":"2.186","kev":false},{"cve":"CVE-2019-10353","published":"2019-07-17","fixed":"2.186","kev":false},{"cve":"CVE-2019-10354","published":"2019-07-17","fixed":"2.186","kev":false},{"cve":"CVE-2019-10383","published":"2019-08-28","fixed":"2.192","kev":false,"link":{"from":"CVE-2019-10354","to":"CVE-2019-10383","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.main:jenkins-core","fromFixed":"2.176.2","toFixed":"2.176.3","daysApart":42}]}},{"cve":"CVE-2019-10384","published":"2019-08-28","fixed":"2.192","kev":false,"link":{"from":"CVE-2019-10354","to":"CVE-2019-10384","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.main:jenkins-core","fromFixed":"2.176.2","toFixed":"2.176.3","daysApart":42}]}},{"cve":"CVE-2019-10401","published":"2019-09-25","fixed":"2.197","kev":false}],"package":"Maven:org.jenkins-ci.main:jenkins-core"}}