CVE-2014-2066

Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

Score

CVSS 2.0 6.8 Medium

Status

Modified - security@debian.org

Published

2014-10-17

Last modified

2024-08-06

Weaknesses

CWE-287

Affected products

• Jenkins (Jenkins)

References

• http://www.openwall.com/lists/oss-security/2014/02/21/2
• https://github.com/jenkinsci/jenkins/commit/8ac74c350779921598f9d5edfed39dd35de8842a
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14