{"cve":"CVE-2019-1003049","nvd":{"published":"2019-04-10T21:29:01.480","modified":"2026-06-17T02:09:36.827","status":"Modified","description":"Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-613"],"references":["http://www.securityfocus.com/bid/107901","https://access.redhat.com/errata/RHBA-2019:1605","https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289","https://www.oracle.com/security-alerts/cpuapr2022.html","http://www.securityfocus.com/bid/107901"],"products":["jenkins:jenkins","oracle:communications_cloud_native_core_automated_test_suite","redhat:openshift_container_platform"],"source":"nvd","synced_at":"2026-10-19T20:55:22.313337056+00:00"},"epss":{"cve":"CVE-2019-1003049","score":0.02111,"percentile":0.81801,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-742j-jcfr-23w3","url":"https://osv.dev/vulnerability/GHSA-742j-jcfr-23w3","summary":"Insufficient Session Expiration in Jenkins","modified":"2023-11-08T04:00:37.725737Z","packages":[{"ecosystem":"Maven","name":"org.jenkins-ci.main:jenkins-core","purl":"pkg:maven/org.jenkins-ci.main/jenkins-core","ranges":["<2.164.2"],"fixed":["2.164.2"]},{"ecosystem":"Maven","name":"org.jenkins-ci.main:jenkins-core","purl":"pkg:maven/org.jenkins-ci.main/jenkins-core","ranges":[">=2.165 <2.172"],"fixed":["2.172"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}