PT-2016-4418 · Cloudbees+1 · Jenkins

Arshan Dabirsiaghi · Published 2016-04-07 · Updated 2025-06-18 · CVE-2016-0792

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.650 Jenkins LTS versions prior to 1.642.2

Description The issue allows remote authenticated users to execute arbitrary code via serialized data in an XML file. This is related to XStream and the groovy.util.Expando class. Multiple unspecified API endpoints are affected.

Recommendations For Jenkins versions prior to 1.650, update to version 1.650 or later. For Jenkins LTS versions prior to 1.642.2, update to version 1.642.2 or later. As a temporary workaround, consider restricting access to the affected API endpoints until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2016-0792

GHSA-45RG-G72W-R393

MGASA-2016-0162

RHSA-2016:0711

RHSA-2016:1773

Affected Products

Jenkins

References · 20

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_xstream_deserialize.rb · Exploit
• 🔥 https://github.com/jpiechowka/jenkins-cve-2016-0792 · Exploit
• 🔥❌ https://github.com/R0B1NL1N/java-deserialization-exploits · Exploit, Deleted
• 🔥 https://exploit-db.com/exploits/43375 · Exploit
• 🔥 https://contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream · Exploit
• 🔥 https://exploit-db.com/exploits/42394 · Exploit
• 🔥❌ https://github.com/s0wr0b1ndef/java-deserialization-exploits · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2016-0792 · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2016-March/179009.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0162 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0162.html · Security Note
• https://access.redhat.com/errata/RHSA-2016:0711 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1773.html · Vendor Advisory
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-45rg-g72w-r393 · Vendor Advisory