medium6.8
CVE-2014-2066
Jenkins session fixation vulnerability
Impact
Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | >= 1.533, < 1.551 | 1.551 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Jenkins | through 1.532.1 through 1.550 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2014/02/21/2
- https://github.com/jenkinsci/jenkins/commit/8ac74c350779921598f9d5edfed39dd35de8842a
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
- https://github.com/advisories/GHSA-8jfx-h6q2-v4g3
- https://nvd.nist.gov/vuln/detail/CVE-2014-2066