CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2016-9299
Critical (9.8). EPSS 97% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.19.3, 2.32.
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
Severity
- EPSS
- 97% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-90
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- jenkins:jenkins
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2x9h-h3c4-wqqh | Maven | org.jenkins-ci.main:jenkins-core | >=2.20 <2.32 | 2.32 |
| GHSA-2x9h-h3c4-wqqh | Maven | org.jenkins-ci.main:jenkins-core | <2.19.3 | 2.19.3 |
References
- http://www.openwall.com/lists/oss-security/2016/11/12/4
- http://www.openwall.com/lists/oss-security/2016/11/14/9
- http://www.securityfocus.com/bid/94281
- http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition
- https://groups.google.com/forum/#%21original/jenkinsci-advisories/-fc-w9tNEJE/GRvEzWoJBgAJ