Description

Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.

Remediation

References

CVE-2022-0538

Related Vulnerabilities

Joomla! Core 3.x.x Remote Code Execution (3.7.0 - 3.8.7)

Ampache Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2022-4665)

WordPress Cross-Site Scripting Vulnerability (3.9.3 - 4.2)

XOOPS Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-3296)

Jboss EAP Improper Authentication Vulnerability (CVE-2020-14299)

Severity

High

Classification

CVE-2022-0538 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities