Jenkins HttpOnly flag not Set for session cookies
Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-9635US | medium5.3 | — | ||
Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obt… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2015/01/22/3WEB
- http://www.securityfocus.com/bid/72054WEB
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1185151WEB
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710WEB
- https://issues.jenkins-ci.org/browse/JENKINS-25019WEB
- https://jenkins.io/changelog-oldWEB
- https://nvd.nist.gov/vuln/detail/CVE-2014-9635ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan