CVE-2014-2060: Medium severity jenkins lts vulnerability
Published Oct 17, 2014
·Updated
The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
Affected Software
4 affected componentsFixes available
Jenkins Jenkins<=1.550
Jenkins Jenkins<=1.532.1
maven/org.jenkins-ci.main:jenkins-core>=1.533<1.551
1.551
maven/org.jenkins-ci.main:jenkins-core<1.532.2
1.532.2
Event History
Oct 17, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·03:53 AM
Data Sourced
via GitHub·03:53 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2060?
CVE-2014-2060 is considered a high severity vulnerability due to its potential for session hijacking.
2
How do I fix CVE-2014-2060?
To fix CVE-2014-2060, update Jenkins to versions 1.551 or later, or the LTS version 1.532.2 or later.
3
Which versions of Jenkins are affected by CVE-2014-2060?
CVE-2014-2060 affects Jenkins versions prior to 1.551 and LTS versions prior to 1.532.2.
4
What type of attack is facilitated by CVE-2014-2060?
CVE-2014-2060 allows remote attackers to hijack sessions, compromising user authentication.
5
Is there a workaround for CVE-2014-2060?
There are no known workarounds for CVE-2014-2060; the best mitigation is to update to a secure version.