Threats tagged 'ghsa-q5xj-w646-fr8r'

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where HTTP Basic authentication requests, including those using an API token, can obtain a "remember me" cookie. This allows attackers who have obtained a user's API token to maintain access to Jenkins via the "remember me" cookie even after the API token is revoked or expires.