CVE-2015-8103

Published: Nov 25, 2015Modified: May 6, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".

Affected (4)

Products: Redhat: Openshift Container Platform · Jenkins: Jenkins

1 product

Openshift Container Platform

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 2.2
Redhat Openshift Container Platform	Version 3.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Jenkins Jenkins	Before 1.638
Jenkins Jenkins	Before 1.625.2

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (24)

http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#jenkins

Source: cve@mitre.org

Exploit

http://packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://rhn.redhat.com/errata/RHSA-2016-0489.html

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/11/09/5

Source: cve@mitre.org

Mailing List

http://www.openwall.com/lists/oss-security/2015/11/18/11

Source: cve@mitre.org

Mailing List

http://www.openwall.com/lists/oss-security/2015/11/18/13

Source: cve@mitre.org

Mailing List

http://www.openwall.com/lists/oss-security/2015/11/18/2

Source: cve@mitre.org

Mailing List

http://www.securityfocus.com/bid/77636

Source: cve@mitre.org

Broken Link

https://access.redhat.com/errata/RHSA-2016:0070

Source: cve@mitre.org

Third Party Advisory

https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli

Source: cve@mitre.org

Exploit

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Source: cve@mitre.org

Vendor Advisory

https://www.exploit-db.com/exploits/38983/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#jenkins

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://rhn.redhat.com/errata/RHSA-2016-0489.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/11/09/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.openwall.com/lists/oss-security/2015/11/18/11

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.openwall.com/lists/oss-security/2015/11/18/13

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.openwall.com/lists/oss-security/2015/11/18/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.securityfocus.com/bid/77636

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://access.redhat.com/errata/RHSA-2016:0070

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.exploit-db.com/exploits/38983/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.