Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2014-9634

Good to know:

icon

Date: September 12, 2017

Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.

Language: Java

Severity Score

Related Resources (9)

https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710
https://jenkins.io/changelog-old/
https://bugzilla.redhat.com/show_bug.cgi?id=1185148
https://nvd.nist.gov/vuln/detail/CVE-2014-9634
http://www.openwall.com/lists/oss-security/2015/01/22/3
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682
http://www.securityfocus.com/bid/72054
https://issues.jenkins-ci.org/browse/JENKINS-25019
https://www.mend.io/vulnerability-database/CVE-2014-9634

Severity Score

Weakness Type (CWE)

Security Features

CWE-254

Top Fix

icon

Upgrade Version

Upgrade to version jenkins-1.586

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us