Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins | — | Upgrade Jenkins to the latest version | Apr 25, 2018 | Sep 12, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub