Description

A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.

Remediation

References

https://jenkins.io/security/advisory/2018-08-15/#SECURITY-996

Related Vulnerabilities

CVE-2010-1622 Vulnerability in maven package org.springframework:spring

CVE-2019-10335 Vulnerability in maven package org.jenkins-ci.plugins:electricflow

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth

CVE-2017-2599 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2014-0119 Vulnerability in maven package org.apache.tomcat:tomcat-util-scan

Severity

Medium

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Tags

Vendor Advisory