Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5k7u-6rmq-tyb5
Vulnerability ID VCID-5k7u-6rmq-tyb5
Aliases CVE-2022-34175
GHSA-p3rc-946h-8cf5
Summary Unauthorized view fragment access in Jenkins Jenkins uses the Stapler web framework to render its UI views. These views are frequently composed of several view fragments, enabling plugins to extend existing views with more content. Before [SECURITY-534](https://www.jenkins.io/security/advisory/2019-07-17/#SECURITY-534) was fixed in Jenkins 2.186 and LTS 2.176.2, attackers could in some cases directly access a view fragment containing sensitive information, bypassing any permission checks in the corresponding view. In Jenkins 2.335 through 2.355 (both inclusive), the protection added for SECURITY-534 is disabled for some views. As a result, attackers could in very limited cases directly access a view fragment containing sensitive information, bypassing any permission checks in the corresponding view. As of publication, the Jenkins security team is unaware of any vulnerable view fragment across the Jenkins plugin ecosystem. Jenkins 2.356 restores the protection for affected views. No Jenkins LTS release is affected by this issue, as it was not present in Jenkins 2.332.x and fixed in the 2.346.x line before 2.346.1.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-693 Protection Mechanism Failure
CWE-863 Incorrect Authorization
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34175.json
epss 0.03089 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.03089 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.03089 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.03089 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.03089 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.03089 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.04136 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.04136 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.04136 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.04136 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.04136 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.04136 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
epss 0.04136 https://api.first.org/data/v1/epss?cve=CVE-2022-34175
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-p3rc-946h-8cf5
cvssv3.1 7.5 https://github.com/jenkinsci/jenkins
generic_textual HIGH https://github.com/jenkinsci/jenkins
cvssv3.1 7.5 https://github.com/jenkinsci/jenkins/commit/37bd66a43ad561f670db7440f493d69518741d27
generic_textual HIGH https://github.com/jenkinsci/jenkins/commit/37bd66a43ad561f670db7440f493d69518741d27
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-34175
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-34175
cvssv3.1 7.5 https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2777
generic_textual HIGH https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2777
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34175.json
https://api.first.org/data/v1/epss?cve=CVE-2022-34175
https://github.com/jenkinsci/jenkins
https://github.com/jenkinsci/jenkins/commit/37bd66a43ad561f670db7440f493d69518741d27
https://nvd.nist.gov/vuln/detail/CVE-2022-34175
https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2777
2119655 https://bugzilla.redhat.com/show_bug.cgi?id=2119655
GHSA-p3rc-946h-8cf5 https://github.com/advisories/GHSA-p3rc-946h-8cf5
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34175.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/jenkinsci/jenkins
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/jenkinsci/jenkins/commit/37bd66a43ad561f670db7440f493d69518741d27
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-34175
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2777
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.86786
EPSS Score 0.03089
Published At April 13, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:07:27.163451+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-p3rc-946h-8cf5/GHSA-p3rc-946h-8cf5.json 38.0.0