Lucene search

Veracode Vulnerability DatabaseVERACODE:14784

HistoryMay 02, 2019 - 4:55 a.m.

Session Fixation

2019-05-0204:55:59

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

JSON

jenkins is vulnerable to session fixation. The vulnerability exists as jenkins does not invalidate API token when a user is deleted.

CPENameOperatorVersion
jenkinseq1.554.2__1.el6op
jenkinseq1.509.1__1.el6op
jenkinseq1.488__2.el6op
jenkinseq1.502__1.el6op
jenkinseq1.498__1.1.el6op
jenkinseq1.506__1.el6op
openshift-origin-cartridge-jenkinseq1.20.3.4__1.el6op
openshift-origin-cartridge-jenkinseq1.20.3.3__1.el6op
openshift-origin-cartridge-jenkinseq1.9.8__1.el6op
openshift-origin-cartridge-jenkinseq1.16.1__2.el6op

Name	Operator	Version
jenkins	eq	1.554.2__1.el6op
jenkins	eq	1.509.1__1.el6op
jenkins	eq	1.488__2.el6op
jenkins	eq	1.502__1.el6op
jenkins	eq	1.498__1.1.el6op
jenkins	eq	1.506__1.el6op
openshift-origin-cartridge-jenkins	eq	1.20.3.4__1.el6op
openshift-origin-cartridge-jenkins	eq	1.20.3.3__1.el6op
openshift-origin-cartridge-jenkins	eq	1.9.8__1.el6op
openshift-origin-cartridge-jenkins	eq	1.16.1__2.el6op

Rows per page:

1-10 of 341

References

www.openwall.com/lists/oss-security/2014/02/21/2

access.redhat.com/security/cve/CVE-2013-5573

access.redhat.com/security/cve/CVE-2013-6372

access.redhat.com/security/cve/CVE-2013-7330

access.redhat.com/security/cve/CVE-2014-2059

access.redhat.com/security/cve/CVE-2014-2060

access.redhat.com/security/cve/CVE-2014-2061

access.redhat.com/security/cve/CVE-2014-2062

access.redhat.com/security/cve/CVE-2014-2063

access.redhat.com/security/cve/CVE-2014-2064

access.redhat.com/security/cve/CVE-2014-2065

access.redhat.com/security/cve/CVE-2014-2066

access.redhat.com/security/cve/CVE-2014-2067

access.redhat.com/security/cve/CVE-2014-2068

access.redhat.com/security/cve/CVE-2014-3661

access.redhat.com/security/cve/CVE-2014-3662

access.redhat.com/security/cve/CVE-2014-3663

access.redhat.com/security/cve/CVE-2014-3664

access.redhat.com/security/cve/CVE-2014-3665

access.redhat.com/security/cve/CVE-2014-3666

access.redhat.com/security/cve/CVE-2014-3667

access.redhat.com/security/cve/CVE-2014-3678

access.redhat.com/security/cve/CVE-2014-3681

bugzilla.redhat.com/show_bug.cgi?id=1127667

github.com/jenkinsci/jenkins/commit/5548b5220cfd496831b5721124189ff18fbb12a3

rhn.redhat.com/errata/RHBA-2014-1630.html

wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

JSON

Related for VERACODE:14784