Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04amZ4LWg2cTItdjRnM84AAdTg

Jenkins session fixation vulnerability

Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

Permalink: https://github.com/advisories/GHSA-8jfx-h6q2-v4g3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04amZ4LWg2cTItdjRnM84AAdTg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 2 months ago

Identifiers: GHSA-8jfx-h6q2-v4g3, CVE-2014-2066
References:

• https://nvd.nist.gov/vuln/detail/CVE-2014-2066
• https://github.com/jenkinsci/jenkins/commit/8ac74c350779921598f9d5edfed39dd35de8842a
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
• http://www.openwall.com/lists/oss-security/2014/02/21/2
• https://github.com/advisories/GHSA-8jfx-h6q2-v4g3

Repository: https://github.com/jenkinsci/jenkins
Blast Radius: 1.0

Affected Packages