CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2019-10354
Medium (4.3). EPSS 1.6% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.176.2, 2.186.
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Severity
- EPSS
- 1.6% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:jenkins
- redhat:openshift_container_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6jfc-mc97-c7wg | Maven | org.jenkins-ci.main:jenkins-core | <2.176.2 | 2.176.2 |
| GHSA-6jfc-mc97-c7wg | Maven | org.jenkins-ci.main:jenkins-core | >=2.177 <2.186 | 2.186 |
| GHSA-6jfc-mc97-c7wg | Maven | org.kohsuke.stapler:stapler-parent | <1.257.1 | 1.257.1 |