Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2016 02 24 | — | Upgrade Jenkins to version 1.650Upgrade Jenkins LTS to version 1.642.2Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest version | Nov 13, 2017 | Apr 7, 2016 |
| Redhat Openshift | — | Upgrade openshift-origin-broker-utilUpgrade openshift-origin-node-proxyUpgrade openshift-origin-cartridge-jenkinsUpgrade openshift-origin-cartridge-nodejsUpgrade openshift-origin-cartridge-jenkins-clientUpgrade rubygem-openshift-origin-frontend-haproxy-sni-proxyUpgrade openshift-origin-node-utilUpgrade activemqUpgrade rubygem-openshift-origin-controllerUpgrade openshift-origin-cartridge-phpUpgrade openshift-origin-brokerUpgrade openshift-origin-cartridge-mongodbUpgrade openshift-origin-cartridge-perlUpgrade jenkins-plugin-credentialsUpgrade openshift-origin-cartridge-jbossewsUpgrade jenkins-plugin-kubernetesUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade ImageMagickUpgrade jenkins-plugin-openshift-pipelineUpgrade libcgroupUpgrade openshift-origin-cartridge-haproxyUpgrade rhcUpgrade rubygem-openshift-origin-nodeUpgrade openshift-origin-cartridge-cronUpgrade openshift-origin-cartridge-mysqlUpgrade rubygem-openshift-origin-admin-consoleUpgrade jenkinsUpgrade rubygem-openshift-origin-routing-daemonUpgrade jenkins-plugin-durable-taskUpgrade openshift-origin-cartridge-jbosseapUpgrade openshift-origin-msg-node-mcollectiveUpgrade openshift-origin-cartridge-pythonUpgrade openshift-origin-cartridge-rubyUpgrade openshift-origin-cartridge-diy | Jun 18, 2018 | Feb 24, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub