Description

Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.

Remediation

References

CVE-2014-9634

Related Vulnerabilities

WordPress Plugin Rockhoist Ratings SQL Injection (1.2.1)

WordPress Plugin Beautiful Stat Counter for WordPress-Everest Counter Lite includes Backdoor [Only if downloaded via the vendor website] (2.0.7)

Apache HTTP Server Use After Free Vulnerability (CVE-2019-0196)

Internet Information Services Other Vulnerability (CVE-2000-1147)

WordPress Plugin Simple PDF Viewer Cross-Site Scripting (1.9)

Severity

Medium

Classification

CVE-2014-9634 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities