Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
APP:MISC:JENKINS-CI-SERVER-CE |
|---|---|
Severity |
Major |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
APP |
Keywords |
Jenkins CI Server Arbitrary Code Execution |
Release Date |
2016/02/01 |
Update Number |
2635 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
APP: Jenkins CI Server Arbitrary Code Execution
This signature detects attempts to exploit a known vulnerability in Jenkins CI Server. Successful exploitation can result in arbitrary code execution
Extended Description
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Affected Products
- Jenkins jenkins 1.625.1
- Jenkins jenkins 1.637
- Redhat openshift 2.0
- Redhat openshift 3.1
References