CVE-2019-10354

Опубликовано: 17 июл. 2019

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

Ссылки

http://www.openwall.com/lists/oss-security/2019/07/17/2
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/109373
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:2503
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2548
Third Party Advisory
https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534
Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/07/17/2
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/109373
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:2503
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2548
Third Party Advisory
https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*

Версия до 2.176.1 (включая)

cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*

Версия до 2.185 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*

EPSS

Процентиль: 42%

0.00196

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

CVE-2019-10354

CVSS3: 4.3

redhat

больше 6 лет назад

CVE-2019-10354

CVSS3: 4.3

debian

больше 6 лет назад

A vulnerability in the Stapler web framework used in Jenkins 2.185 and ...

GHSA-6jfc-mc97-c7wg

CVSS3: 4.3

github

больше 3 лет назад

Missing Authorization in Jenkins

EPSS

Процентиль: 42%

0.00196

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-862