GHSA-8jfx-h6q2-v4g3

Jenkins session fixation vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2014-2066

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	>= 1.533, < 1.551	1.551
Maven	org.jenkins-ci.main:jenkins-core	< 1.532.2	1.532.2

Details

As written in the advisory (Markdown source, shown as plain text).

Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-2066 advisory
https://github.com/jenkinsci/jenkins/commit/8ac74c350779921598f9d5edfed39dd35de8842a web
https://github.com/jenkinsci/jenkins package
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 web
http://www.openwall.com/lists/oss-security/2014/02/21/2 web