PT-2017-10042

CVE-2016-9299

Published

2016-11-30

Updated

2022-05-14

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.32 Jenkins LTS versions prior to 2.19.3

Description The issue allows remote attackers to execute arbitrary code via a crafted serialized Java object. This object triggers an LDAP query to a third-party server.

Recommendations For Jenkins versions prior to 2.32, update to version 2.32 or later. For Jenkins LTS versions prior to 2.19.3, update to version 2.19.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Alisa Esage

Matthias Kaiser

Vendors

Affected products

Weakness enumeration

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\'LDAP Injection\')

Related identifiers