PT-2016-4418 · Cloudbees+1 · Jenkins

Arshan Dabirsiaghi · Publicado 2016-04-07 · Atualizado 2025-06-18 · CVE-2016-0792

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.650 Jenkins LTS versions prior to 1.642.2

Description The issue allows remote authenticated users to execute arbitrary code via serialized data in an XML file. This is related to XStream and the groovy.util.Expando class. Multiple unspecified API endpoints are affected.

Recommendations For Jenkins versions prior to 1.650, update to version 1.650 or later. For Jenkins LTS versions prior to 1.642.2, update to version 1.642.2 or later. As a temporary workaround, consider restricting access to the affected API endpoints until a patch is available.

Exploit

Correção

Deserialization of Untrusted Data

RCE

Enumeração de Fraquezas

CWE-502

CWE-20

Identificadores relacionados

CVE-2016-0792

GHSA-45RG-G72W-R393

MGASA-2016-0162

RHSA-2016:0711

RHSA-2016:1773

Produtos afetados

Jenkins

Referências · 20

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_xstream_deserialize.rb · Exploit
• 🔥 https://github.com/jpiechowka/jenkins-cve-2016-0792 · Exploit
• 🔥❌ https://github.com/R0B1NL1N/java-deserialization-exploits · Exploit, Deleted
• 🔥 https://exploit-db.com/exploits/43375 · Exploit
• 🔥 https://contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream · Exploit
• 🔥 https://exploit-db.com/exploits/42394 · Exploit
• 🔥❌ https://github.com/s0wr0b1ndef/java-deserialization-exploits · Exploit, Deleted
• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/7f202f0317e60cd3160f61467b8558f864f83f41 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0792 · Nota de Segurança
• https://lists.fedoraproject.org/pipermail/package-announce/2016-March/179009.html · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2016-0162 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=18033 · Nota
• https://advisories.mageia.org/MGASA-2016-0162.html · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2016:0711 · Aviso do Fabricante