VDB
CVE-2016-0792
CVE-2016-0792
PUBLISHED
KEV
CVSS 8.800000190734863 HIGH
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
EPSS 83.26% · 99.7th percentile
Risk Scores
CVSS 3.0
8.800000190734863
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
83.26%
99.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 1.643, 0 |
| n/a | n/a | n/a |
| jenkins | jenkins | 0, 0 |
| redhat | openshift | 3.1 |
Timeline
- Apr 7, 2016 CVE Published
- Jul 30, 2017 PoC Published
- Jul 31, 2017 PoC Published
- Dec 19, 2017 PoC Published
- Dec 19, 2017 PoC Published
- May 29, 2018 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
References
- RHSA-2016:1773 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2016-0792 advisory
- https://github.com/jenkinsci/jenkins/commit/7f202f0317e60cd3160f61467b8558f864f83f41 url
- https://access.redhat.com/errata/RHSA-2016:0711 url
- https://github.com/jenkinsci/jenkins package
- https://www.exploit-db.com/exploits/42394 url
- https://www.exploit-db.com/exploits/43375 url
- https://www.exploit-db.com/exploits/42394/ technical
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24 patch
- https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream exploit
- https://www.exploit-db.com/exploits/43375/ technical