Lucene search

[email protected]CVE-2019-1003049

HistoryApr 10, 2019 - 9:29 p.m.

CVE-2019-1003049

2019-04-1021:29:01

CWE-613

[email protected]

web.nvd.nist.gov

jenkins

cve

authentication

cli

remote access

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.1%

JSON

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

Affected configurations

NVD

Node

jenkinsjenkinsRange≤2.164.1lts

Node

jenkinsjenkinsRange≤2.171

Node

redhatopenshift_container_platformMatch3.11

Node

oraclecommunications_cloud_native_core_automated_test_suiteMatch1.9.0

CPENameOperatorVersion
jenkins:jenkinsjenkinsle2.164.1

CPE	Name	Operator	Version
jenkins:jenkins	jenkins	le	2.164.1

CNA Affected

[
  {
    "product": "Jenkins",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "2.171 and earlier, LTS 2.164.1 and earlier"
      }
    ]
  }
]