Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2019-1003004
HistoryJan 22, 2019 - 2:29 p.m.

CVE-2019-1003004

2019-01-2214:29:00
[email protected]
web.nvd.nist.gov
3

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.003

Percentile

66.1%

JSON

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.

Affected configurations

Nvd
Node
jenkinsjenkinsRange≤2.150.1lts
OR
jenkinsjenkinsRange≤2.159-
Node
redhatopenshift_container_platformMatch3.11
VendorProductVersionCPE
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*
redhatopenshift_container_platform3.11cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

Related

cvelist 2
osv 4
prion 2
veracode 1
redhatcve 2
github 2
cve 2
alpinelinux 1
nvd 1
openvas 4
nessus 1
cvelist
cvelist
CVE-2019-1003004
2019-01-22 14:00:00
CVE-2019-1003049
2019-04-10 20:12:29
osv
osv
CVE-2019-1003004
2019-01-22 14:29:00
Improper Authorization in Jenkins Core
2022-05-13 01:05:22
CVE-2019-1003049
2019-04-10 21:29:01
prion
prion
Authorization
2019-01-22 14:29:00
Authentication flaw
2019-04-10 21:29:00
veracode
veracode
Insecure Session Management
2019-05-16 03:24:12
redhatcve
redhatcve
CVE-2019-1003004
2020-04-09 10:33:33
CVE-2019-1003049
2019-04-15 03:50:05
github
github
Improper Authorization in Jenkins Core
2022-05-13 01:05:22
Insufficient Session Expiration in Jenkins
2022-05-13 01:01:01
cve
cve
CVE-2019-1003004
2019-01-22 14:29:00
CVE-2019-1003049
2019-04-10 21:29:01
alpinelinux
alpinelinux
CVE-2019-1003049
2019-04-10 21:29:01
nvd
nvd
CVE-2019-1003049
2019-04-10 21:29:01
openvas
openvas
Jenkins < 2.160 and < 2.150.2 LTS Multiple Vulnerabilities - Windows
2019-01-23 00:00:00
Jenkins < 2.160 and < 2.150.2 LTS Multiple Vulnerabilities - Linux
2019-01-23 00:00:00
Jenkins < 2.164.2 LTS and < 2.172 Multiple Vulnerabilities - Linux
2019-04-17 00:00:00
nessus
nessus
Jenkins < 2.150.2 LTS / 2.160 Multiple Vulnerabilities
2019-01-23 00:00:00

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.003

Percentile

66.1%

JSON
Related for NVD:CVE-2019-1003004
cvelist2osv4prion2veracode1redhatcve2github2cve2alpinelinux1nvd1openvas4nessus1