Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2016 02 24 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins to version 1.650Upgrade Jenkins LTS to version 1.642.2 | Nov 13, 2017 | Apr 7, 2016 |
| Redhat Openshift | — | Upgrade openshift-origin-cartridge-rubyUpgrade rubygem-openshift-origin-nodeUpgrade openshift-origin-cartridge-cronUpgrade jenkins-plugin-kubernetesUpgrade openshift-origin-msg-node-mcollectiveUpgrade jenkins-plugin-openshift-pipelineUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade jenkinsUpgrade openshift-origin-cartridge-mysqlUpgrade rubygem-openshift-origin-routing-daemonUpgrade openshift-origin-cartridge-jbossewsUpgrade openshift-origin-cartridge-diyUpgrade jenkins-plugin-durable-taskUpgrade openshift-origin-cartridge-haproxyUpgrade libcgroupUpgrade rhcUpgrade rubygem-openshift-origin-admin-consoleUpgrade openshift-origin-cartridge-pythonUpgrade openshift-origin-cartridge-jbosseapUpgrade ImageMagickUpgrade openshift-origin-brokerUpgrade openshift-origin-node-utilUpgrade openshift-origin-cartridge-nodejsUpgrade openshift-origin-cartridge-perlUpgrade activemqUpgrade openshift-origin-cartridge-mongodbUpgrade openshift-origin-node-proxyUpgrade openshift-origin-cartridge-phpUpgrade openshift-origin-broker-utilUpgrade rubygem-openshift-origin-frontend-haproxy-sni-proxyUpgrade rubygem-openshift-origin-controllerUpgrade jenkins-plugin-credentialsUpgrade openshift-origin-cartridge-jenkins-clientUpgrade openshift-origin-cartridge-jenkins | Jun 18, 2018 | Feb 24, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub