Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Jenkins Insufficient Session Expiration Vulnerability - CVE-2019-1003004 - Vulnerability Database
Jenkins

Jenkins Insufficient Session Expiration Vulnerability - CVE-2019-1003004

High
Reference: CVE-2019-1003004
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-1003004
Title: Jenkins Insufficient Session Expiration Vulnerability
Overview:

An improper authorization vulnerability exists in Jenkins 2.158 and earlier LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.