Description
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
Remediation
References
Related Vulnerabilities
MySQL CVE-2024-20981 Vulnerability (CVE-2024-20981)
OpenSSL Other Vulnerability (CVE-2002-0656)
WordPress Plugin NextGEN Gallery-WordPress Gallery Arbitrary File Upload (2.1.10)
Roundcube Improper Input Validation Vulnerability (CVE-2011-1492)
Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-9933)