GHSA-8qxp-g8jv-p37x

ghsaUSosv

Improper Authorization in Jenkins Core

view advisory published 2022-05-13Licence: CC-BY-4.0

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-1003004US	high7.2	1.62% (76th)	—	2019-01-22
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/106680WEB
https://access.redhat.com/errata/RHBA-2019:0327WEB
https://jenkins.io/security/advisory/2019-01-16/#SECURITY-901WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-1003004ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan