Vulnerability in Jenkins
CVE-2019-1003049
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
EPSS: 0.021 (79.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Jenkins
- Jenkins Project — versions 2.171 and earlier, LTS 2.164.1 and earlier
- Oracle Communications_cloud_native_core_automated_test_suite — versions 1.9.0
- Redhat Openshift_container_platform — versions 3.11
Weakness classification (CWE)
Public proof-of-concept exploits
References
- jenkinsci-cert@googlegroups.com (vdb-entry, Broken Link, x_refsource_BID)
- jenkinsci-cert@googlegroups.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- jenkinsci-cert@googlegroups.com (Patch, Third Party Advisory, x_refsource_MISC)
- jenkinsci-cert@googlegroups.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-1003049?
- CVE-2019-1003049 is a high-severity vulnerability in Jenkins, classified under Insufficient Session Expiration. CVSS score: 8.1/10. Published 2019-04-10.
- How severe is CVE-2019-1003049?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2019-1003049 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.