CVE-2014-9635

5.3 mediumEPSS 2.7%

Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.

Severity

CVSS 3.0

5.3 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 2.7% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-254
Published: 2017-09-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:jenkins

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-7f6w-fhmr-j8hq	Maven	org.jenkins-ci.main:jenkins-core	<1.586	1.586

References

http://www.openwall.com/lists/oss-security/2015/01/22/3
http://www.securityfocus.com/bid/72054
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682
https://bugzilla.redhat.com/show_bug.cgi?id=1185151
https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710

Check your stack JSON