UpHeron
All vulnerabilities

Servers and applications

CVE-2019-1003049

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

Severity
High 8.1
Published
10 Apr 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2.1% in the next 30 daysHigher than 81% of CVEs. EPSS by FIRST, 10 Nov 2026
Weakness
Insufficient session expiration (CWE-613)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Affected software

SoftwareAffected versions
JenkinsServers and applications · cpe:a:jenkins:jenkins
  • Every version up to 2.164.1
  • Every version up to 2.171

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-1003049
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-1003049