Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2016 02 24 | — | Upgrade Jenkins to version 1.650Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 1.642.2Upgrade Jenkins to the latest version | Nov 13, 2017 | Apr 7, 2016 |
| Redhat Openshift | — | Upgrade openshift-origin-cartridge-diyUpgrade rubygem-openshift-origin-admin-consoleUpgrade jenkins-plugin-kubernetesUpgrade rubygem-openshift-origin-nodeUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade openshift-origin-cartridge-cronUpgrade openshift-origin-cartridge-jbossewsUpgrade rhcUpgrade openshift-origin-msg-node-mcollectiveUpgrade jenkins-plugin-openshift-pipelineUpgrade libcgroupUpgrade openshift-origin-cartridge-rubyUpgrade rubygem-openshift-origin-routing-daemonUpgrade openshift-origin-cartridge-mysqlUpgrade jenkinsUpgrade openshift-origin-cartridge-haproxyUpgrade jenkins-plugin-durable-taskUpgrade ImageMagickUpgrade openshift-origin-cartridge-pythonUpgrade openshift-origin-cartridge-jbosseapUpgrade openshift-origin-node-utilUpgrade openshift-origin-broker-utilUpgrade openshift-origin-cartridge-jenkinsUpgrade openshift-origin-cartridge-phpUpgrade rubygem-openshift-origin-controllerUpgrade openshift-origin-cartridge-nodejsUpgrade rubygem-openshift-origin-frontend-haproxy-sni-proxyUpgrade openshift-origin-brokerUpgrade openshift-origin-cartridge-mongodbUpgrade activemqUpgrade openshift-origin-cartridge-perlUpgrade jenkins-plugin-credentialsUpgrade openshift-origin-node-proxyUpgrade openshift-origin-cartridge-jenkins-client | Jun 18, 2018 | Feb 24, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub