VYPR
← All advisories
Moderate severityNVD Advisory· Published Oct 17, 2014· Updated May 6, 2026

CVE-2014-2066

CVE-2014-2066

Description

Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.main:jenkins-coreMaven
>= 1.533, < 1.5511.551
org.jenkins-ci.main:jenkins-coreMaven
< 1.532.21.532.2

Affected products

2
  • Jenkins/Jenkins2 versions
    cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*range: <=1.550
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*range: <=1.532.1

Patches

1
8ac74c350779

[FIXED SECURITY-75] Invalidate session after login to avoid session fixation

https://github.com/jenkinsci/jenkinsVojtech JuranekJun 13, 2013via ghsa
commit
1 file changed · +1 −0
  • core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java+1 −0 modified
    @@ -85,6 +85,7 @@ protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServle
         // HttpSessionContextIntegrationFilter stores the updated SecurityContext object into this session later
         // (either when a redirect is issued, via its HttpResponseWrapper, or when the execution returns to its
         // doFilter method.
+        request.getSession().invalidate();
         request.getSession();
     }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.