CVE-2014-9635

Published: Sep 12, 2017

Modified: Aug 6, 2024

PUBLISHED

Description

Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

[oss-security] 20150122 Re: ping on CVE Request for jenkins-tomcat: Secure and HttpOnly flags are not, set for cookies with Jenkins on Tomcat

mailing-list

x_refsource_MLIST

https://issues.jenkins-ci.org/browse/JENKINS-25019

x_refsource_MISC

https://bugzilla.redhat.com/show_bug.cgi?id=1185151

x_refsource_CONFIRM

https://jenkins.io/changelog-old/

x_refsource_CONFIRM

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682

x_refsource_CONFIRM

https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710

x_refsource_CONFIRM

72054

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2014-9635

Description

Affected Products

References