CVE-2019-1003004: High severity jenkins lts vulnerability
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1003004?
CVE-2019-1003004 is classified as a medium severity vulnerability due to improper authorization allowing session duration extension.
How do I fix CVE-2019-1003004?
To fix CVE-2019-1003004, upgrade Jenkins to version 2.160 or later, or LTS version 2.150.2 or later.
What versions of Jenkins are affected by CVE-2019-1003004?
Jenkins versions 2.158 and earlier, as well as LTS version 2.150.1 and earlier, are affected by CVE-2019-1003004.
Can CVE-2019-1003004 affect Red Hat OpenShift Container Platform?
Yes, Red Hat OpenShift Container Platform version 3.11 is also affected by CVE-2019-1003004.
What type of attack is possible due to CVE-2019-1003004?
CVE-2019-1003004 allows attackers to extend the duration of active HTTP sessions indefinitely, which can lead to unauthorized access.