Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API toke
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Jenkins, an open-source automation server used for software build and deployment, is affected by this vulnerability. An attacker who has obtained a user's API token could use it to get a "remember me" cookie, which lets them keep access to Jenkins even after that API token has been revoked or has expired.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Jenkins Project Jenkins
Version range not reported