GitHub Advisoryadvisory · Maven

GHSA-8jfx-h6q2-v4g3 Jenkins session fixation vulnerability

MEDIUM Published 2022-05-17 Modified 2024-03-05 Official page ↗
Aliases
CVE-2014-2066
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2024-03-05

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.533, < 1.551 → fixed in 1.551 • Maven org.jenkins-ci.main:jenkins-core: < 1.532.2 → fixed in 1.532.2

Description

Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

Related

Alias · CVE (1)

  • CVE-2014-2066 Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References