Jenkins allows Deserialization of Untrusted Data via an XML File

ALTO 8.8CVE-2016-0792 · GHSA-45rg-g72w-r393 · Published 07/04/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 1.643, < 1.650< 1.642.2`	`1.6501.642.2`
jenkins jenkins	`≤ 1.642.1≤ 1.649`	No fix yet
openshift redhat	`= 3.1`	No fix yet

Description

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-0792 · ADVISORY
jenkinsci/jenkins commit 7f202f0 · WEB
access.redhat.com/errata/RHSA-2016:0711 · WEB
jenkinsci/jenkins · PACKAGE
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24 · WEB
contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream · WEB
exploit-db.com/exploits/42394 · WEB
exploit-db.com/exploits/43375 · WEB
rhn.redhat.com/errata/RHSA-2016-1773.html · WEB
exploit-db.com/exploits/42394
exploit-db.com/exploits/43375

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free