GitHub Advisoryadvisory · Maven
GHSA-7f6w-fhmr-j8hq Jenkins HttpOnly flag not Set for session cookies
MEDIUM
Official page ↗
- Aliases
- CVE-2014-9635
- Ecosystem
- Maven
- Packages
- org.jenkins-ci.main:jenkins-core
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Reviewed
- 2024-01-30
Affected packages
• Maven org.jenkins-ci.main:jenkins-core: < 1.586 → fixed in 1.586
Description
Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
Related
Alias · CVE (1)
- CVE-2014-9635 Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-9635 advisory
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710 web
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682 web
- https://bugzilla.redhat.com/show_bug.cgi?id=1185151 web
- https://issues.jenkins-ci.org/browse/JENKINS-25019 web
- https://jenkins.io/changelog-old web
- http://www.openwall.com/lists/oss-security/2015/01/22/3 web
- http://www.securityfocus.com/bid/72054 web