Description

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Remediation

References

CVE-2016-0792

Related Vulnerabilities

MySQL CVE-2023-22026 Vulnerability (CVE-2023-22026)

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-10545)

WordPress Plugin BA Book Everything Cross-Site Scripting (1.3.24)

WordPress Plugin WP Support Plus Responsive Ticket System Unspecified Vulnerability (8.0.7)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2013-6420)

Severity

High

Classification

CVE-2016-0792 CWE-20 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities