GitHub Advisoryadvisory · Maven

GHSA-45rg-g72w-r393 Jenkins allows Deserialization of Untrusted Data via an XML File

HIGH Published 2022-05-14 Modified 2025-03-13 Official page ↗
Aliases
CVE-2016-0792
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-502
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.643, < 1.650 → fixed in 1.650 • Maven org.jenkins-ci.main:jenkins-core: < 1.642.2 → fixed in 1.642.2

Description

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Related

Alias · CVE (1)

  • CVE-2016-0792 Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References