Description
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
Remediation
References
http://rhn.redhat.com/errata/RHSA-2016-1773.html
https://access.redhat.com/errata/RHSA-2016:0711
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24
https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream
https://www.exploit-db.com/exploits/42394/
https://www.exploit-db.com/exploits/43375/
Related Vulnerabilities
CVE-2020-8910 Vulnerability in maven package org.webjars.npm:google-closure-library
CVE-2018-20164 Vulnerability in npm package uap-core
CVE-2015-0250 Vulnerability in maven package org.apache.xmlgraphics:batik-dom
CVE-2018-20595 Vulnerability in maven package org.hswebframework.web:hsweb-system-oauth2-client-web
CVE-2015-20110 Vulnerability in npm package generator-jhipster