Описание
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.
Ссылки
- Broken Link
- Third Party Advisory
- Vendor Advisory
- Broken Link
- Third Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
Связанные уязвимости
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.
An improper authorization vulnerability exists in Jenkins 2.158 and ea ...
Уязвимость компонента TokenBasedRememberMeServices2.java (core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java) сервера автоматизации Jenkins, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
7.2 High
CVSS3
6.5 Medium
CVSS2