Signature Detail
Short Name |
HTTP:JENKINS-CI-SERVER-CE |
|---|---|
Severity |
High |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Jenkins CI Server Arbitrary Code Execution |
Release Date |
2016/02/01 |
Update Number |
2635 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+ |
HTTP: Jenkins CI Server Arbitrary Code Execution
This signature detects attempts to exploit a known vulnerability in Jenkins CI Server. Successful exploitation can result in arbitrary code execution
Extended Description
The Jenkins CLI subsystem in CloudBees Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in ysoserial ".
Affected Products
- Cloudbees jenkins 1.625.1
- Cloudbees jenkins 1.637
References