https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Bug ID: 1730869 Summary: CVE-2019-10354 jenkins: Unauthorized view fragment access (SECURITY-534) Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190717,reported=20190717,sour ce=internet,cvss3=4.3/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U /C:L/I:N/A:N,cwe=CWE-200,openshift-enterprise-3.6/jenk ins=new,openshift-enterprise-3.7/jenkins=new,openshift -enterprise-3.9/jenkins=new,openshift-enterprise-3.10/ jenkins=new,openshift-enterprise-3.11/jenkins=new,open shift-enterprise-4.1/jenkins=new,fedora-all/jenkins=af fected Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: lpardo@redhat.com CC: abenaiss@redhat.com, adam.kaplan@redhat.com, ahardin@redhat.com, aos-bugs@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, eparis@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jokerman@redhat.com, mchappel@redhat.com, mizdebsk@redhat.com, msrb@redhat.com, vbobade@redhat.com, wzheng@redhat.com Target Milestone: --- Classification: Other
A vulnerability was found in Jenkins versions weekly before 2.186 and LTS before 2.176.2. Jenkins uses the Stapler web framework to render its UI views. These views are frequently comprised of several view fragments, enabling plugins to extend existing views with more content. In some cases attackers could directly access a view fragment containing sensitive information, bypassing any permission checks in the corresponding view.