VDB
CVE-2019-1003004
CVE-2019-1003004
PUBLISHED
CVSS 7.199999809265137 HIGH
Reported by jenkins · Published January 22, 2019
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
Risk Scores
CVSS 3.0
7.199999809265137
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins project | Jenkins | 2.158 and earlier, LTS 2.150.1 and earlier |
| Jenkins project | Jenkins | 2.158 and earlier, LTS 2.150.1 and earlier, *, 2.158 and earlier, LTS 2.150.1 and earlier |
| Maven | org.jenkins-ci.main:jenkins-core | 2.150.1, 2.150.1 |
Timeline
- Jan 22, 2019 CVE Published
- Oct 9, 2019 CVE Updated
- Apr 14, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
References
- x_refsource_CONFIRM
- 106680 vdb-entryx_refsource_BID
- RHBA-2019:0327 vendor-advisoryx_refsource_REDHAT
- https://nvd.nist.gov/vuln/detail/CVE-2019-1003004 advisory