CVE-2019-1003004
Improper Authorization in Jenkins Core
7.2 HighFix available
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
1.62%Up 0.8 points since Apr 14, 2021
What each source reports
NVD Score used
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
- Record
CVE-2019-1003004- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
- Record
CVE-2019-1003004- Updated
- 2026-11-02
EUVDEUVD-2022-3220 No score
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
- Record
EUVD-2022-3220- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8qxp-g8jv-p37x
Improper Authorization in Jenkins Core
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
- Record
GHSA-8qxp-g8jv-p37x- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
OSV
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
- Record
CVE-2019-1003004- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-8qxp-g8jv-p37x
Improper Authorization in Jenkins Core
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
- Record
GHSA-8qxp-g8jv-p37x- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
OSVRHBA-2019:0326
Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update
- Record
RHBA-2019:0326- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
before 2.159 | 2.159 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.159, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.159 |
atomic-enterprise-service-catalogRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 1:3.11.82-1.git.1673.133961e.el7 | 1:3.11.82-1.git.1673.133961e.el7 |
atomic-enterprise-service-catalog-svcatRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 1:3.11.82-1.git.1673.133961e.el7 | 1:3.11.82-1.git.1673.133961e.el7 |
atomic-openshiftRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-clientsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-cluster-autoscalerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.efb6af0.el7 | 0:3.11.82-1.git.0.efb6af0.el7 |
atomic-openshift-deschedulerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.300.89765c9.el7 | 0:3.11.82-1.git.300.89765c9.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
atomic-openshift-dockerregistryRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.452.0ce6383.el7 | 0:3.11.82-1.git.452.0ce6383.el7 |
atomic-openshift-excluderRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-hyperkubeRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-hypershiftRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-masterRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-metrics-serverRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.52.2fdca3f.el7 | 0:3.11.82-1.git.52.2fdca3f.el7 |
atomic-openshift-nodeRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-node-problem-detectorRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.254.a448936.el7 | 0:3.11.82-1.git.254.a448936.el7 |
atomic-openshift-podRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-service-idlerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.14.e353758.el7 | 0:3.11.82-1.git.14.e353758.el7 |
atomic-openshift-template-service-brokerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-testsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-web-consoleRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.355.5e8b1d9.el7 | 0:3.11.82-1.git.355.5e8b1d9.el7 |
golang-github-openshift-oauth-proxyRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.425.7cac034.el7 | 0:3.11.82-1.git.425.7cac034.el7 |
golang-github-prometheus-alertmanagerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.3bf41ce.el7 | 0:3.11.82-1.git.0.3bf41ce.el7 |
golang-github-prometheus-node_exporterRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.1063.48444e8.el7 | 0:3.11.82-1.git.1063.48444e8.el7 |
golang-github-prometheus-prometheusRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.5027.9d24833.el7 | 0:3.11.82-1.git.5027.9d24833.el7 |
haproxyRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:1.8.17-3.el7 | 0:1.8.17-3.el7 |
haproxy-debuginfoRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:1.8.17-3.el7 | 0:1.8.17-3.el7 |
haproxy18Red Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:1.8.17-3.el7 | 0:1.8.17-3.el7 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:2.150.2.1549032159-1.el7 | 0:2.150.2.1549032159-1.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.1549642489-1.el7 | 0:3.11.1549642489-1.el7 |
openshift-ansibleRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-docsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-playbooksRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-rolesRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-testRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-enterprise-autohealRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.219.0b5aff4.el7 | 0:3.11.82-1.git.219.0b5aff4.el7 |
openshift-enterprise-cluster-capacityRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.380.cf11c51.el7 | 0:3.11.82-1.git.380.cf11c51.el7 |
prometheusRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.5027.9d24833.el7 | 0:3.11.82-1.git.5027.9d24833.el7 |
prometheus-alertmanagerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.3bf41ce.el7 | 0:3.11.82-1.git.0.3bf41ce.el7 |
prometheus-node-exporterRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.1063.48444e8.el7 | 0:3.11.82-1.git.1063.48444e8.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-1003004 is a high vulnerability (CVSS 7.2) in Jenkins, published January 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.62%, the 76th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.159.
References
jenkins.io/security/advisory/2019-01-16
securityfocus.com/bid/106680
access.redhat.com/errata/RHBA-2019:0327
nvd.nist.gov/vuln/detail/CVE-2019-1003004
github.com/advisories/GHSA-8qxp-g8jv-p37x
Show 99 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1506736
security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0326.json
cve.org/CVERecord?id=CVE-2018-20102
mail-archive.com/[email protected]/msg32055.html
This page doesn't list everything
Left out here: 474 versions. The JSON record has them.