Vulnerability Description
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Jenkins | <= 1.649 |
| Redhat | Openshift | 3.1 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2016-1773.html
- https://access.redhat.com/errata/RHSA-2016:0711
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-2PatchVendor Advisory
- https://www.contrastsecurity.com/security-influencers/serialization-must-die-actExploit
- https://www.exploit-db.com/exploits/42394/
- https://www.exploit-db.com/exploits/43375/
- http://rhn.redhat.com/errata/RHSA-2016-1773.html
- https://access.redhat.com/errata/RHSA-2016:0711
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-2PatchVendor Advisory
- https://www.contrastsecurity.com/security-influencers/serialization-must-die-actExploit
- https://www.exploit-db.com/exploits/42394/
- https://www.exploit-db.com/exploits/43375/
FAQ
What is CVE-2016-0792?
CVE-2016-0792 is a vulnerability with a CVSS score of 8.8 (HIGH). Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and ...
How severe is CVE-2016-0792?
CVE-2016-0792 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-0792?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Jenkins, Redhat Openshift.