CVE-2019-16539: Missing permission check in Jenkins Support Core Plugin
Summary
CVE-2019-16539: Missing permission check in Jenkins Support Core Plugin. Affects org.jenkins-ci.plugins:support-core versions < 2.64. Fixed in 2.64. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Support Core Plugin is a component of the Jenkins automation server that provides core support functionality. It allows users to generate and manage support bundles, which contain diagnostic information for troubleshooting purposes. The plugin is widely used in various software development and continuous integration environments.
Vulnerability Detail
The Jenkins Support Core Plugin version 2.63 and earlier suffer from a missing permission check vulnerability. Attackers with Overall/Read permission can exploit this vulnerability to delete support bundles. This can lead to unauthorized access to sensitive diagnostic information and potential disruption of troubleshooting processes.
How To Fix
Latest published version: 1865.v45d40b_778b_cb_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.64
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the Jenkins Support Core Plugin.
Conclusion
The missing permission check vulnerability in Jenkins Support Core Plugin version 2.63 and earlier can allow attackers with Overall/Read permission to delete support bundles. To mitigate this vulnerability, users should upgrade to version 2.64 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:support-core →
FAQ
This vulnerability allows attackers with Overall/Read permission to delete support bundles, potentially compromising diagnostic information and disrupting troubleshooting processes.
Users of Jenkins Support Core Plugin versions 2.63 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, users should upgrade to Jenkins Support Core Plugin version 2.64 or later to fix this vulnerability.
No, upgrading to the fixed version is the recommended solution to mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:support-core.
