Servers and applications
CVE-2014-9634
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
- Severity
- Medium 5.3
- Published
- 12 Sept 2017
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 2.7% in the next 30 daysHigher than 86% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- CWE-254
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read some data
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
JenkinsServers and applications · cpe:a:jenkins:jenkins |
|