CVE-2014-9634
- State
- Published
- Severity
- Not scored
- Published
- Sep 12, 2017
- Updated
- Aug 6, 2024
- Reserved
- Jan 22, 2015
Description
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [oss-security] 20150122 Re: ping on CVE Request for jenkins-tomcat: Secure and HttpOnly flags are not, set for cookies with Jenkins on Tomcatmailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1185148
- https://jenkins.io/changelog-old/
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682
- https://issues.jenkins-ci.org/browse/JENKINS-25019
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710
- 72054vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.