Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Jenkins Insufficient Session Expiration Vulnerability - CVE-2019-1003003 - Vulnerability Database
Jenkins

Jenkins Insufficient Session Expiration Vulnerability - CVE-2019-1003003

High
Reference: CVE-2019-1003003
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-1003003
Title: Jenkins Insufficient Session Expiration Vulnerability
Overview:

An improper authorization vulnerability exists in Jenkins 2.158 and earlier LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire allowing e.g. to persist access to temporarily compromised user accounts.