Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-10354

CVE-2019-10354: Missing Authorization in Jenkins

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-10354
GHSA ID
GHSA-6jfc-mc97-c7wg
EPSS Score
0.44776%
CWE
CWE-425
Published
5/24/2022
Updated
12/22/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.main:jenkins-coremaven<= 2.176.12.176.2
org.jenkins-ci.main:jenkins-coremaven>= 2.177, <= 2.1852.186
org.kohsuke.stapler:stapler-parentmaven< 1.257.11.257.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from Stapler's view dispatching mechanism not performing authorization checks. The fix introduced DispatchValidator integration in Facet's dispatcher creation (via createValidatingDispatcher) and added validation in ScriptRequestDispatcher. The original vulnerable functions were the view dispatching entry points that lacked these checks, particularly in Jelly/Groovy view rendering paths. The commits show these components were modified to add security validation, confirming they were the missing authorization points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility in t** St*pl*r w** *r*m*work us** in J*nkins *.*** *n* **rli*r, LTS *.***.* *n* **rli*r *llow** *tt**k*rs to ****ss vi*w *r**m*nts *ir**tly, *yp*ssin* p*rmission ****ks *n* possi*ly o*t*in s*nsitiv* in*orm*tion.

Reasoning

T** vuln*r**ility st*mm** *rom St*pl*r's vi*w *isp*t**in* m****nism not p*r*ormin* *ut*oriz*tion ****ks. T** *ix intro*u*** `*isp*t**V*li**tor` int**r*tion in `****t`'s *isp*t***r *r**tion (vi* `*r**t*V*li**tin**isp*t***r`) *n* ***** v*li**tion in `S