Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2016 02 24 | — | Upgrade Jenkins LTS to version 1.642.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins to version 1.650 | Nov 13, 2017 | Apr 7, 2016 |
| Redhat Openshift | — | Upgrade rubygem-openshift-origin-routing-daemonUpgrade openshift-origin-cartridge-cronUpgrade openshift-origin-cartridge-pythonUpgrade rubygem-openshift-origin-admin-consoleUpgrade rubygem-openshift-origin-nodeUpgrade jenkins-plugin-durable-taskUpgrade jenkins-plugin-kubernetesUpgrade rhcUpgrade openshift-origin-cartridge-jbosseapUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade openshift-origin-cartridge-jbossewsUpgrade libcgroupUpgrade jenkinsUpgrade openshift-origin-cartridge-mysqlUpgrade ImageMagickUpgrade openshift-origin-cartridge-haproxyUpgrade openshift-origin-cartridge-diyUpgrade openshift-origin-msg-node-mcollectiveUpgrade jenkins-plugin-openshift-pipelineUpgrade openshift-origin-cartridge-rubyUpgrade jenkins-plugin-credentialsUpgrade openshift-origin-node-proxyUpgrade openshift-origin-cartridge-phpUpgrade openshift-origin-cartridge-jenkinsUpgrade openshift-origin-cartridge-jenkins-clientUpgrade openshift-origin-cartridge-nodejsUpgrade openshift-origin-brokerUpgrade rubygem-openshift-origin-frontend-haproxy-sni-proxyUpgrade activemqUpgrade openshift-origin-cartridge-mongodbUpgrade openshift-origin-node-utilUpgrade openshift-origin-cartridge-perlUpgrade openshift-origin-broker-utilUpgrade rubygem-openshift-origin-controller | Jun 18, 2018 | Feb 24, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub