Improper Authentication in Jenkins - CVE-2019-1003049
Published: April 10, 2019 / Updated: August 3, 2020
Vulnerability identifier: #VU33179
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-1003049
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
Affected software
Jenkins
Arch Linux
jenkins (Alpine package)
Arch Linux
jenkins (Alpine package)
How to mitigate CVE-2019-1003049
Install update from vendor's website.
Jenkins - update to 2.172
jenkins (Alpine package) - update to 2.164.2-r0
jenkins (Alpine package) - update to 2.164.2-r0