An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.
CVSS Details
- CVSS 3.1 Base Score: 7.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2019 01 16 | — | Upgrade Jenkins to version 2.160Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.150.2 | Jan 23, 2019 | Jan 22, 2019 |
| Redhat Openshift | — | Upgrade atomic-openshift-metrics-serverUpgrade openshift-ansibleUpgrade openshift-enterprise-cluster-capacityUpgrade golang-github-prometheus-prometheusUpgrade jenkins-2-pluginsUpgrade atomic-openshiftUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-cluster-autoscalerUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshift-web-consoleUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-dockerregistryUpgrade golang-github-prometheus-node_exporterUpgrade jenkinsUpgrade haproxyUpgrade atomic-openshift-service-idlerUpgrade openshift-enterprise-autohealUpgrade golang-github-openshift-oauth-proxyUpgrade golang-github-prometheus-alertmanager | Apr 25, 2019 | Jan 16, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub