PT-2017-6378 · Jenkins+1 · Jenkins+1

Published 2017-09-12 · Updated 2022-05-17 · CVE-2014-9635

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.586

Description The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies, as the HttpOnly flag is not set in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later.

Recommendations For versions prior to 1.586, update to version 1.586 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2014-9635

GHSA-7F6W-FHMR-J8HQ

Affected Products

Jenkins

Apache Tomcat

References · 10

• https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-9635 · Security Note
• https://osv.dev/vulnerability/GHSA-7f6w-fhmr-j8hq · Vendor Advisory
• https://jenkins.io/changelog-old · Vendor Advisory
• https://issues.jenkins-ci.org/browse/JENKINS-25019 · Vendor Advisory
• http://openwall.com/lists/oss-security/2015/01/22/3 · Note
• http://securityfocus.com/bid/72054 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9635 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1185151 · Note