Description
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | 2.185 and earlier, LTS 2.176.1 and earlier | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.176.2.1563461785-1.el7 | RHSA-2019:2548 |
| Red Hat OpenShift 3 | jenkins | 2.176.2.1563460897-1.el7 | RHSA-2019:2503 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.176.2 | 2.176.2 | GHSA-6jfc-mc97-c7wg |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.177, < 2.186 | 2.186 | GHSA-6jfc-mc97-c7wg |
| Maven | org.kohsuke.stapler:stapler-parent | < 1.257.1 | 1.257.1 | GHSA-6jfc-mc97-c7wg |
Advisories 2
- RHSA-2019:2548 Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2019:2503 Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- [oss-security] 20190717 Multiple vulnerabilities in Jenkins mailing-list
- 109373 vdb-entry
- RHSA-2019:2503 vendor-advisory
- RHSA-2019:2548 vendor-advisory
- https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534