Missing authorization in Jenkins
Priority LOW 23CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.
Summary
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Why it matters now
EPSS 0.01617 76th percentileScored 2026-11-07
Fix Partial org.jenkins-ci.main:jenkins-core (Maven): 2.176.2, 2.186org.kohsuke.stapler:stapler-parent (Maven): 1.257.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins | 2.185 and earlier, LTS 2.176.1 and earlier | — | No fix listed | CNA |
| — | org.jenkins-ci.main:jenkins-core (Maven) | before 2.176.2 | 2.176.2 | Patch available | GHSA-6jfc-mc97-c7wg |
| — | org.jenkins-ci.main:jenkins-core (Maven) | 2.177 to before 2.186 | 2.186 | Patch available | GHSA-6jfc-mc97-c7wg |
| — | org.kohsuke.stapler:stapler-parent (Maven) | before 1.257.1 | 1.257.1 | Patch available | GHSA-6jfc-mc97-c7wg |
- Jenkins VendorJenkins Affected 2.185 and earlier, LTS 2.176.1 and earlier Fixed in — No fix listed CNA
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.176.2 Fixed in 2.176.2 Patch available GHSA-6jfc-mc97-c7wg
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.177 to before 2.186 Fixed in 2.186 Patch available GHSA-6jfc-mc97-c7wg
- org.kohsuke.stapler:stapler-parent (Maven) Vendor— Affected before 1.257.1 Fixed in 1.257.1 Patch available GHSA-6jfc-mc97-c7wg
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* | up to 2.176.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* | up to 2.185 | Vulnerable | Jenkins |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | Red Hat |
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions up to 2.176.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* Versions up to 2.185 Vulnerable ·Jenkins
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-6jfc-mc97-c7wg org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.176.2 Advisory →
- Fix · GHSA-6jfc-mc97-c7wg org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.186 Advisory →
- Fix · GHSA-6jfc-mc97-c7wg org.kohsuke.stapler:stapler-parent (Maven) Fixed in 1.257.1 Advisory →
Red Hat 2 advisories
- RHSA-2019:2548 Released 2019-08-28 · Red Hat rating ImportantOpenShift Container Platform 4.1 jenkins security update
- Red Hat OpenShift Container Platform 4.1 jenkins-2.176.2.1563461785-1.el7
- RHSA-2019:2503 Released 2019-08-15 · Red Hat rating ImportantOpenShift Container Platform 3.11 jenkins security update
- Red Hat OpenShift Container Platform 3.11 jenkins-2.176.2.1563460897-1.el7
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Jenkins — RHSA-2019:2503
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2019-07661 Path traversal in JenkinsPriority MEDIUM 41
- TI-2019-07662 Cross-site request forgery in JenkinsPriority LOW 36
- Advisory ·
Jenkins — RHSA-2019:2548
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2019-07661 Path traversal in JenkinsPriority MEDIUM 41
- TI-2019-07662 Cross-site request forgery in JenkinsPriority LOW 36
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.6 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2019:2503 |
| Red Hat OpenShift Container Platform 4.1 | Fixed | RHSA-2019:2548 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10354
- 2026-10-03 Alias added: GHSA-6jfc-mc97-c7wg
References
Advisory 5
More Jenkins vulnerabilities
- TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
- TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2019-10354 · CVE Program
- CVE-2019-10354 · NVD
- FIRST EPSS
- GHSA-6jfc-mc97-c7wg · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10354 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences