https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Bug ID: 1730869
Summary: CVE-2019-10354 jenkins: Unauthorized view fragment
access (SECURITY-534)
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190717,reported=20190717,sour
ce=internet,cvss3=4.3/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U
/C:L/I:N/A:N,cwe=CWE-200,openshift-enterprise-3.6/jenk
ins=new,openshift-enterprise-3.7/jenkins=new,openshift
-enterprise-3.9/jenkins=new,openshift-enterprise-3.10/
jenkins=new,openshift-enterprise-3.11/jenkins=new,open
shift-enterprise-4.1/jenkins=new,fedora-all/jenkins=af
fected
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: abenaiss(a)redhat.com, adam.kaplan(a)redhat.com,
ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, eparis(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com, vbobade(a)redhat.com, wzheng(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins versions weekly before 2.186 and LTS
before 2.176.2. Jenkins uses the Stapler web framework to render its UI views.
These views are frequently comprised of several view fragments, enabling
plugins to extend existing views with more content. In some cases attackers
could directly access a view fragment containing sensitive information,
bypassing any permission checks in the corresponding view.
--
You are receiving this mail because:
You are on the CC list for the bug.