Description

The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2016-1773.html

https://access.redhat.com/errata/RHSA-2016:0711

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24

Related Vulnerabilities

CVE-2020-1940 Vulnerability in maven package org.apache.jackrabbit:oak-core

CVE-2011-0013 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2023-47324 Vulnerability in maven package org.silverpeas.core:silverpeas-core-rs

CVE-2023-48240 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-default

CVE-2019-8331 Vulnerability in maven package org.webjars.bowergithub.jasny:bootstrap

Severity

Critical

Classification

CWE-264 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Vendor Advisory