Improper Authorization in Jenkins Core

Also known as GHSA-6rh5-23hx-j452

Published 7 y ago 2019-01-22 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.2

v3.1 · NVD

CISA KEV

not known exploited

EPSS

1.5%

percentile 75%

Public exploits

none known

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.

Exploit prediction (EPSS)

1.54% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	7.2	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	6.5	`AV:N/AC:L/Au:S/C:P/I:P/A:P`
GitHub	3.1	7.2	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.jenkins-ci.main:jenkins-core`	<2.150.2 >=2.151, <2.159	2.150.2 2.159

Affected products

Jenkins project Jenkins

Classification

Weakness

CWE-285 Improper Authorization

Technology feeds

Jenkins (RSS, critical only)

References

jenkins.io /security/advisory/2019-01-16/#SECURITY-868 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/106680 · vdb-entry, x_refsource_BID, x_transferred
access.redhat.com /errata/RHBA-2019:0327 · vendor-advisory, x_refsource_REDHAT, x_transferred
nvd.nist.gov /vuln/detail/CVE-2019-1003003 · advisory
github.com /jenkinsci/jenkins/commit/7b4649657f90e98a5564cf5f0892deaa5fee0454 · web
github.com /jenkinsci/jenkins · package
web.archive.org /web/20200227092104/http://www.securityfocus.com/bid/106680 · web

Sources

CVE List: CVE-2019-1003003
GitHub Advisory: GHSA-6rh5-23hx-j452
NVD: CVE-2019-1003003

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary