| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | ≥ 2.122, < 2.138< 2.121.3 | 2.1382.121.3 |
| jenkins | ≤ 2.121.2≤ 2.137 |
A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free