← Back

CVE-2019-1003049

nvd nist
Published: Apr 10, 2019Modified: Nov 21, 2024

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: NVD

Description

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

Affected (4)

Jenkins
1 product
Jenkins
Redhat
1 product
Openshift Container Platform
Oracle
1 product
Communications Cloud Native Core Automated Test Suite
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Jenkins
Up to 2.164.1
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Jenkins
Up to 2.171
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Openshift Container Platform
Version 3.11
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Communications Cloud Native Core Automated Test Suite
Version 1.9.0

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (8)

Source: jenkinsci-cert@googlegroups.com
Broken Link
Source: jenkinsci-cert@googlegroups.com
Third Party Advisory
Source: jenkinsci-cert@googlegroups.com
Vendor Advisory
Source: jenkinsci-cert@googlegroups.com
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.