An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.

Affected Packages

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 0 (fixed in 2.150.2)

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 2.151 (fixed in 2.159)

Related CVEs

CVE-2019-1003003

Key Information

GHSA ID

GHSA-6rh5-23hx-j452

Published

May 13, 2022 1:05 AM

Last Modified

March 12, 2024 2:28 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.main:jenkins-core

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.