Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session…
Priority LOW 29CWE-254Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
Why it matters now
EPSS 0.0272 86th percentileScored 2026-11-07
Fix Partial org.jenkins-ci.main:jenkins-core (Maven): 1.586Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.jenkins-ci.main:jenkins-core (Maven) | before 1.586 | 1.586 | Patch available | GHSA-7f6w-fhmr-j8hq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 1.586 Fixed in 1.586 Patch available GHSA-7f6w-fhmr-j8hq
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* | up to 1.585 | Vulnerable | Jenkins |
| cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:* | 7.0.41 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:* | 7.0.42 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:* | 7.0.43 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:* | 7.0.44 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:* | 7.0.45 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:* | 7.0.46 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:* | 7.0.47 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:* | 7.0.48 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:* | 7.0.49 | Running on | Apache |
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* Versions up to 1.585 Vulnerable ·Jenkins
- cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:* Versions 7.0.41 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:* Versions 7.0.42 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:* Versions 7.0.43 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:* Versions 7.0.44 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:* Versions 7.0.45 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:* Versions 7.0.46 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:* Versions 7.0.47 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:* Versions 7.0.48 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:* Versions 7.0.49 Running on ·Apache
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:* | 7.0.50 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.51:*:*:*:*:*:*:* | 7.0.51 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:* | 7.0.54 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:* | 7.0.55 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:* | 7.0.56 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:* | 7.0.57 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.58:*:*:*:*:*:*:* | 7.0.58 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:* | 7.0.59 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.60:*:*:*:*:*:*:* | 7.0.60 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:* | 7.0.61 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:* | 7.0.62 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:* | 7.0.63 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:* | 7.0.64 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:* | 7.0.65 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.66:*:*:*:*:*:*:* | 7.0.66 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:* | 7.0.67 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.68:*:*:*:*:*:*:* | 7.0.68 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.69:*:*:*:*:*:*:* | 7.0.69 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.70:*:*:*:*:*:*:* | 7.0.70 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.71:*:*:*:*:*:*:* | 7.0.71 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.72:*:*:*:*:*:*:* | 7.0.72 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.73:*:*:*:*:*:*:* | 7.0.73 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.74:*:*:*:*:*:*:* | 7.0.74 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.75:*:*:*:*:*:*:* | 7.0.75 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.76:*:*:*:*:*:*:* | 7.0.76 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.77:*:*:*:*:*:*:* | 7.0.77 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.78:*:*:*:*:*:*:* | 7.0.78 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.79:*:*:*:*:*:*:* | 7.0.79 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.80:*:*:*:*:*:*:* | 7.0.80 | Running on | Apache |
| cpe:2.3:a:apache:tomcat:7.0.81:*:*:*:*:*:*:* | 7.0.81 | Running on | Apache |
- cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:* Versions 7.0.50 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.51:*:*:*:*:*:*:* Versions 7.0.51 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:* Versions 7.0.54 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:* Versions 7.0.55 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:* Versions 7.0.56 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:* Versions 7.0.57 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.58:*:*:*:*:*:*:* Versions 7.0.58 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:* Versions 7.0.59 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.60:*:*:*:*:*:*:* Versions 7.0.60 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:* Versions 7.0.61 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:* Versions 7.0.62 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:* Versions 7.0.63 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:* Versions 7.0.64 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:* Versions 7.0.65 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.66:*:*:*:*:*:*:* Versions 7.0.66 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:* Versions 7.0.67 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.68:*:*:*:*:*:*:* Versions 7.0.68 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.69:*:*:*:*:*:*:* Versions 7.0.69 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.70:*:*:*:*:*:*:* Versions 7.0.70 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.71:*:*:*:*:*:*:* Versions 7.0.71 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.72:*:*:*:*:*:*:* Versions 7.0.72 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.73:*:*:*:*:*:*:* Versions 7.0.73 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.74:*:*:*:*:*:*:* Versions 7.0.74 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.75:*:*:*:*:*:*:* Versions 7.0.75 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.76:*:*:*:*:*:*:* Versions 7.0.76 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.77:*:*:*:*:*:*:* Versions 7.0.77 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.78:*:*:*:*:*:*:* Versions 7.0.78 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.79:*:*:*:*:*:*:* Versions 7.0.79 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.80:*:*:*:*:*:*:* Versions 7.0.80 Running on ·Apache
- cpe:2.3:a:apache:tomcat:7.0.81:*:*:*:*:*:*:* Versions 7.0.81 Running on ·Apache
Remediation
- Fix · GHSA-7f6w-fhmr-j8hq org.jenkins-ci.main:jenkins-core (Maven) Fixed in 1.586 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Enterprise 2 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2014-9635
- 2026-10-03 Alias added: GHSA-7f6w-fhmr-j8hq
References
Advisory 6
- [oss-security] 20150122 Re: ping on CVE Request for jenkins-tomcat: Secure and HttpOnly flags are not, set for cookies with Jenkins on Tomcat
- https://issues.jenkins-ci.org/browse/JENKINS-25019
- https://bugzilla.redhat.com/show_bug.cgi?id=1185151
- https://jenkins.io/changelog-old/
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682
- https://nvd.nist.gov/vuln/detail/CVE-2014-9635
More Jenkins vulnerabilities
- TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
- TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2014-9635 · CVE Program
- CVE-2014-9635 · NVD
- FIRST EPSS
- GHSA-7f6w-fhmr-j8hq · GitHub Advisory Database · CC BY 4.0
- CVE-2014-9635 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences