Sign in
Deutsch English Español Polski
High

Unauthorized view fragment access in Jenkins

  • Disclosed: 24.06.2022
  • Updated: 11.10.2026 11:22

Jenkins uses the Stapler web framework to render its UI views. These views are frequently composed of several view fragments, enabling plugins to extend existing views with more content.

Before SECURITY-534 was fixed in Jenkins 2.186 and LTS 2.176.2, attackers could in some cases directly access a view fragment containing sensitive information, bypassing any permission checks in the corresponding view.

In Jenkins 2.335 through 2.355 (both inclusive), the protection added for SECURITY-534 is disabled for some views. As a result, attackers could in very limited cases directly access a view fragment containing sensitive information, bypassing any permission checks in the corresponding view.

As of publication, the Jenkins security team is unaware of any vulnerable view fragment across the Jenkins plugin ecosystem.

Jenkins 2.356 restores the protection for affected views.

No Jenkins LTS release is affected by this issue, as it was not present in Jenkins 2.332.x and fixed in the 2.346.x line before 2.346.1.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.jenkins-ci.main:jenkins-core >= 2.335, < 2.356 2.356

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE)
CWE-693, CWE-863
Platform
Java / Kotlin (Maven)
Package
org.jenkins-ci.main:jenkins-core
Disclosed
24.06.2022
Updated
11.10.2026 11:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-p3rc-946h-8cf5 - CC BY 4.0

Vulnerability history: org.jenkins-ci.main:jenkins-core

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (259) in the archive
Total entries
259
First → latest
01.2022 06.2026
Without a fix
1
Exploited in attacks
4

Severity breakdown

  • Critical 19
  • High 62
  • Medium 158
  • Low 20

Disclosures per year

Severity:
  1. Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
    High · 8.8 CVE-2026-53435 < 2.555.3, >= 2.556, < 2.568 2.555.3, 2.568
  2. Jenkins: Stored XSS vulnerability in node offline cause description
    High · 8.0 CVE-2026-53441 >= 2.483, < 2.568 2.568
  3. Jenkins has a link following vulnerability allows arbitrary file creation
    High · 8.8 CVE-2026-33001 < 2.555 2.555
  4. Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
    High · 7.5 CVE-2026-33002 >= 2.442, < 2.555 2.555
  5. Jenkins has a stored XSS vulnerability in node offline cause description
    High · 8.0 CVE-2026-27099 >= 2.542, < 2.551, >= 2.483, < 2.541.2 2.551, 2.541.2
  6. Jenkins has a Denial of service vulnerability in HTTP-based CLI
    High · 7.5 CVE-2025-67635 >= 2.529, < 2.541, < 2.528.3 2.541, 2.528.3
  7. Jenkins Remoting library arbitrary file read vulnerability
    High · 9.0 CVE-2024-43044 < 2.452.4, >= 2.460, < 2.462.1, >= 2.470, < 2.471 2.452.4, 2.462.1, 2.471
  8. Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
    Critical · 9.8 Exploited in attacks CVE-2024-23897 >= 1.606, < 2.426.3, >= 2.427, < 2.440.1, >= 2.441, < 2.442 2.426.3, 2.440.1, 2.442
  9. Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
    High · 8.8 CVE-2024-23898 >= 2.217, < 2.426.3, >= 2.427, < 2.442, = 2.441 2.426.3, 2.442
  10. Jenkins temporary plugin file created with insecure permissions
    High · 7.0 CVE-2023-43496 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  11. Jenkins Cross-site Scripting vulnerability
    High · 8.0 CVE-2023-43495 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  12. Jenkins Stored Cross-site Scripting vulnerability
    High · 8.0 CVE-2023-39151 >= 2.402, < 2.414.1, < 2.401.3, >= 2.415, < 2.416 2.414.1, 2.401.3, 2.416
  13. Jenkins CSRF protection bypass vulnerability
    High · 8.0 CVE-2023-35141 < 2.400 2.400
  14. Cross-site Scripting vulnerability in Jenkins
    High · 8.8 CVE-2023-27898 >= 2.376, < 2.394, < 2.375.4 2.394, 2.375.4
  15. Incorrect Authorization in Jenkins Core
    High · 7.0 CVE-2023-27899 >= 2.376, < 2.387.1, < 2.375.4, >= 2.388, < 2.394 2.387.1, 2.375.4, 2.394
  16. Denial of service in Jenkins Core
    High · 7.5 CVE-2023-27901 >= 2.388, < 2.394, < 2.375.4, >= 2.376, < 2.387.1 2.394, 2.375.4, 2.387.1
  17. Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
    High · 8.0 CVE-2022-41224 >= 2.367, < 2.370 2.370
  18. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34170 >= 2.350, < 2.356, >= 2.320, < 2.332.4, >= 2.346, < 2.346.1 2.356, 2.332.4, 2.346.1
  19. Unauthorized view fragment access in Jenkins this entry
    High · 7.5 CVE-2022-34175 >= 2.335, < 2.356 2.356
  20. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34173 >= 2.340, < 2.356 2.356
Show more (20) Showing 20 of 81

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.