CVE-2019-10357

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.

• CWE-862

• http://www.openwall.com/lists/oss-security/2019/07/31/1Mailing List, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2594Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2651Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2662Third Party Advisory
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY1422Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/07/31/1Mailing List, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2594Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2651Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2662Third Party Advisory
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY1422Vendor Advisory

Published

Jul 31, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10351Jenkins Caliper CI Plugin stores credentials unencrypted in …8.8
• CVE-2019-10352A path traversal vulnerability in Jenkins 2.185 and earlier,…
• CVE-2019-10353CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and ea…
• CVE-2019-10354A vulnerability in the Stapler web framework used in Jenkins…4.3
• CVE-2019-10355A sandbox bypass vulnerability in Jenkins Script Security Pl…8.8
• CVE-2019-10356A sandbox bypass vulnerability in Jenkins Script Security Pl…8.8
• CVE-2019-10358Jenkins Maven Integration Plugin 3.3 and earlier did not app…6.5
• CVE-2019-10359A cross-site request forgery vulnerability in Jenkins Maven …6.3
• CVE-2019-1036A cross-site-scripting (XSS) vulnerability exists when Micro…
• CVE-2019-10360A stored cross site scripting vulnerability in Jenkins Maven…5.4
• CVE-2019-10361Jenkins Maven Release Plugin 0.14.0 and earlier stored crede…5.5
• CVE-2019-10362Jenkins Configuration as Code Plugin 1.24 and earlier did no…5.4