Description

Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.

Remediation

References

CVE-2014-9634

Related Vulnerabilities

Oracle Application Server Permissions, Privileges, and Access Controls Vulnerability (CVE-2001-1371)

Oracle Database Server CVE-2009-3413 Vulnerability (CVE-2009-3413)

MediaWiki Incorrect Authorization Vulnerability (CVE-2023-22945)

OpenVPN AS Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability (CVE-2017-5868)

MySQL CVE-2022-21315 Vulnerability (CVE-2022-21315)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CVE-2014-9634