Missing Authorization in Jenkins

published 2019-07-17 7 y ago modified 2026-06-17 4 mo ago also GHSA-6jfc-mc97-c7wg , EUVD-2022-2814

cvss: 4.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.6%; EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits: 0; none known

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

Patch / fix

fixed in 2 distros 2 links 2

maven org.jenkins-ci.main:jenkins-core 2.176.2, 2.186
maven org.kohsuke.stapler:stapler-parent 1.257.1

red hat arch linux

jenkins openshift 4.1 2.176.2.1563461785-1.el7
jenkins openshift 3.11 2.176.2.1563460897-1.el7

red hat advisories RHSA-2019:2548 RHSA-2019:2503

jenkins Arch Linux 2.186-1

arch linux advisories AVG-1012

github.com/jenkinsci/jenkins@279d810 commit
github.com/jenkinsci/stapler@1963755 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-10354 updated 2025-11-21 cvss 4.3

jenkins: Unauthorized view fragment access (SECURITY-534)

Red Hat OpenShift Container Platform 3.6 jenkins Red Hat OpenShift Container Platform 3.7 jenkins Red Hat OpenShift Container Platform 3.9 jenkins Red Hat OpenShift Container Platform 3.10 jenkins
affected: no fix planned “Will not fix”
Red Hat OpenShift Container Platform 3.11 jenkins 2.176.2.1563460897-1.el7
fixed: vendor fix RHSA-2019:2503
Red Hat OpenShift Container Platform 4.1 jenkins 2.176.2.1563461785-1.el7
fixed: vendor fix RHSA-2019:2548

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.62% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.jenkins-ci.main:jenkins-core	<2.176.2 >=2.177, <2.186	2.176.2 2.186
maven	org.kohsuke.stapler:stapler-parent	<1.257.1	1.257.1

Affected products

Jenkins project Jenkins

Classification

Weakness

CWE-862 Missing Authorization
CWE-425 Direct Request

Technology feeds

Jenkins rss critical rss

References

github.com /jenkinsci/jenkins/commit/279d8109eddb7a494428baf25af9756c2e33576b
web
github.com /jenkinsci/stapler/commit/19637555a9f32d3875356b47234131d8b1e9fee4
web
access.redhat.com /errata/RHSA-2019:2503
vendor-advisory, web, third-party-advisory
access.redhat.com /errata/RHSA-2019:2548
vendor-advisory, web, third-party-advisory
jenkins.io /security/advisory/2019-07-17/#SECURITY-534
web, vendor-advisory
openwall.com /lists/oss-security/2019/07/17/2
mailing-list, web, third-party-advisory
securityfocus.com /bid/109373
vdb-entry, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2019-10354
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary