Vulnerability in Jenkins
CVE-2019-1003049
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.021 (81.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 81.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: 0.000
Affected products
- Jenkins
- Jenkins Project — versions 2.171 and earlier, LTS 2.164.1 and earlier
- Oracle Communications Cloud Native Core Automated Test Suite — versions 1.9.0
- Red Hat Openshift Container Platform — versions 3.11
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/107901 (vdb-entry, Broken Link)
- access.redhat.com/errata/RHBA-2019:1605 (vendor-advisory, Third Party Advisory)
- www.oracle.com/security-alerts/cpuapr2022.html (Patch, Third Party Advisory)
- jenkins.io/security/advisory/2019-04-10/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-1003049?
- CVE-2019-1003049 is a high-severity vulnerability in Jenkins, classified under Insufficient Session Expiration. CVSS score: 8.1/10. Published 2019-04-10.
- How severe is CVE-2019-1003049?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2019-1003049 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.