CVE-2014-2060
Jenkins allows Remote Attackers to Hijack Sessions
5.0 MediumFix available
The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
Exploit likelihood
1.55%Up 0.5 points since Feb 4, 2022
What each source reports
NVD Score used
The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
- Record
CVE-2014-2060- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
- Record
CVE-2014-2060- Updated
- 2026-11-02
EUVDEUVD-2014-2107 No score
The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
- Record
EUVD-2014-2107- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9c26-cf8c-mw43
Jenkins allows Remote Attackers to Hijack Sessions
The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
- Record
GHSA-9c26-cf8c-mw43- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVGHSA-9c26-cf8c-mw43
Jenkins allows Remote Attackers to Hijack Sessions
The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
- Record
GHSA-9c26-cf8c-mw43- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
before 1.532.2 | 1.532.2 |
org.jenkins-ci.main:jenkins-coreMaven |
1.533 up to 1.551 | 1.551 |
org.jenkins-ci.main:jenkins-coreMaven |
before 1.532.2, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
1.532.2 |
org.jenkins-ci.main:jenkins-coreMaven |
1.533 up to 1.551, plus listed versions 1.5341.5351.5361.5371.538 Show 12 moreShow less1.5391.5401.5411.5421.5431.5441.5451.5461.5471.5481.5491.550 |
1.551 |
jenkinsRed Hat:openshift:2.0::el6 From an advisory covering 22 CVEs |
before 0:1.565.3-1.el6op | 0:1.565.3-1.el6op |
jenkins-plugin-openshiftRed Hat:openshift:2.0::el6 From an advisory covering 22 CVEs |
before 0:0.6.40.1-0.el6op | 0:0.6.40.1-0.el6op |
openshift-origin-cartridge-jenkinsRed Hat:openshift:2.0::el6 From an advisory covering 22 CVEs |
before 0:1.20.3.5-1.el6op | 0:1.20.3.5-1.el6op |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2060 is a medium vulnerability (CVSS 5.0) in Jenkins, published October 17, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. Fixed in org.jenkins-ci.main:jenkins-core 1.532.2.
References
openwall.com/lists/oss-security/2014/02/21/2
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
nvd.nist.gov/vuln/detail/CVE-2014-2060
github.com/advisories/GHSA-9c26-cf8c-mw43
access.redhat.com/errata/RHBA-2014:1630
Show 89 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1127667
security.access.redhat.com/data/csaf/v2/advisories/2014/rhba-2014_1630.json
cve.org/CVERecord?id=CVE-2013-5573
This page doesn't list everything
Left out here: 113 versions. The JSON record has them.