Description
A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.
Remediation
References
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-637
Related Vulnerabilities
CVE-2021-21606 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2013-4310 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2023-50777 Vulnerability in maven package com.cloudtp.jenkins:paaslane-estimate
CVE-2019-10423 Vulnerability in maven package com.villagechief.codescan.jenkins:codescan