CVE-2016-0792 Jenkins allows Deserialization of Untrusted Data via an XML File
HighCVSS 8.8
EPSS 83.3%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.main/jenkins-core(Maven) | >= 1.643, < 1.650 | 1.650 |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.643 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.644 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.645 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.646 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.647 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.648 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.649 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | < 1.642.2 | 1.642.2 |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.396 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.397 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.398 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.399 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.400 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.401 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.403 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.404 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.405 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.406 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.407 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.408 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409.3 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.410 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.411 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.412 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.413 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.414 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.415 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.416 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.417 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.418 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.419 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.420 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.421 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.422 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.423 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.4 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.5 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.6 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.425 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.426 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.427 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.428 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.429 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.430 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.431 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.432 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.433 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.434 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.435 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.436 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.437 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.438 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.439 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.440 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.441 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.442 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.443 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.444 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.445 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.446 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.447 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.447.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.447.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.448 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.449 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.450 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.451 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.452 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.453 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.454 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.455 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.456 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.457 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.458 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.459 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.460 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.461 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.462 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.463 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.464 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.465 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.466 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.466.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.466.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.467 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.468 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.469 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.470 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.471 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.472 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.473 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.474 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.475 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.476 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.477 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.478 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.479 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.480 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.480.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.480.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.480.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.481 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.482 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.483 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.484 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.485 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.486 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.487 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.488 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.489 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.490 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.491 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.492 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.493 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.494 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.495 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.496 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.497 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.498 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.499 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.500 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.501 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.502 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.503 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.504 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.505 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.506 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.507 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.508 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.2.JENKINS-14362-jzlib | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.2.JENKINS-8856-diag | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.3.JENKINS-14362-jzlib | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.4 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.510 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.511 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.512 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.513 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.514 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.515 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.516 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.516.JENKINS-14362-jzlib | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.517 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.518 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.518.JENKINS-14362-jzlib | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.519 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.520 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.521 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.522 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.523 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.524 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.525 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.526 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.527 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.528 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.529 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.530 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.531 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.1.JENKINS-19453 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.2.JENKINS-21622-diag | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.2.JENKINS-22395-diag | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.3.JENKINS-22395 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.3.JENKINS-22395-2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.533 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.534 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.535 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.536 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.537 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.538 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.539 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.540 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.541 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.542 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.543 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.544 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.545 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.546 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.547 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.548 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.549 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.550 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.551 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.552 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.553 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.554 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- RHSA-2016:0711 vendor-advisory
- github.com product
- wiki.jenkins-ci.org patch vendor-advisory
- www.contrastsecurity.com exploit
- 42394 exploit
- 43375 exploit
- RHSA-2016:1773 vendor-advisory
- github.com