Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-1003049

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

Published

2019-04-10T21:29:01.480

Last Modified

2024-11-21T04:17:48.607

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Primary
CWE-613

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	jenkins	jenkins	≤ 2.164.1	Yes
Application	jenkins	jenkins	≤ 2.171	Yes
Application	redhat	openshift_container_platform	3.11	Yes
Application	oracle	communications_cloud_native_core_automated_test_suite	1.9.0	Yes

References

http://www.securityfocus.com/bid/107901 Broken Link ([email protected])
https://access.redhat.com/errata/RHBA-2019:1605 Third Party Advisory ([email protected])
https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289 Vendor Advisory ([email protected])
https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/107901 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHBA-2019:1605 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)