Insufficient session expiration in Jenkins
Priority LOW 39CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-613.
Summary
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
Why it matters now
EPSS 0.02111 81st percentileScored 2026-11-07
Fix Partial org.jenkins-ci.main:jenkins-core (Maven): 2.164.2, 2.172Red Hat: 1 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins | 2.171 and earlier, LTS 2.164.1 and earlier | — | No fix listed | CNA |
| — | org.jenkins-ci.main:jenkins-core (Maven) | before 2.164.2 | 2.164.2 | Patch available | GHSA-742j-jcfr-23w3 |
| — | org.jenkins-ci.main:jenkins-core (Maven) | 2.165 to before 2.172 | 2.172 | Patch available | GHSA-742j-jcfr-23w3 |
- Jenkins VendorJenkins Affected 2.171 and earlier, LTS 2.164.1 and earlier Fixed in — No fix listed CNA
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.164.2 Fixed in 2.164.2 Patch available GHSA-742j-jcfr-23w3
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.165 to before 2.172 Fixed in 2.172 Patch available GHSA-742j-jcfr-23w3
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* | up to 2.164.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* | up to 2.171 | Vulnerable | Jenkins |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
| cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | Oracle |
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions up to 2.164.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* Versions up to 2.171 Vulnerable ·Jenkins
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
- cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-742j-jcfr-23w3 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.164.2 Advisory →
- Fix · GHSA-742j-jcfr-23w3 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.172 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.4 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.5 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.6 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Fixed | — |
Not affected: 1 product
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1003049
- 2026-10-03 Alias added: GHSA-742j-jcfr-23w3
References
Advisory 3
More Jenkins vulnerabilities
- TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
- TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2019-1003049 · CVE Program
- CVE-2019-1003049 · NVD
- FIRST EPSS
- GHSA-742j-jcfr-23w3 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-1003049 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences