Description

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/07/17/2

http://www.securityfocus.com/bid/109373

https://access.redhat.com/errata/RHSA-2019:2503

https://access.redhat.com/errata/RHSA-2019:2548

https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534

Related Vulnerabilities

CVE-2021-33829 Vulnerability in npm package ckeditor4

CVE-2019-1003048 Vulnerability in maven package com.programmingresearch:prqa-plugin

CVE-2021-23429 Vulnerability in npm package transpile

CVE-2020-7688 Vulnerability in npm package mversion

CVE-2023-35146 Vulnerability in maven package org.jenkins.plugin.templateworkflows:template-workflows

Severity

Medium

Classification

CWE-862 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory