{"id":"CVE-2016-0792","published":"2016-04-07T23:00:00Z","modified":"2024-08-05T22:30:05Z","title":"Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.","provenance":"source","from":"CVE.org"},"summary":{"text":"Jenkins (versions before 1.650 and LTS before 1.642.2) contains a flaw in multiple unspecified API endpoints that handle serialized data via XStream and groovy.util.Expando. An authenticated remote user can exploit it by supplying crafted serialized data in an XML file to execute arbitrary code, with the attack relying on valid user credentials rather than anonymous access.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:19:25Z"},"cvss":null,"epss":{"score":0.83259,"percentile":0.99678,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.exploit-db.com/exploits/43375/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0711","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.exploit-db.com/exploits/42394/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream","tags":["x_refsource_MISC"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1773.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":[">=1.643, <1.650","<1.642.2"],"patched":["1.650","1.642.2"],"from":["GHSA-45rg-g72w-r393"],"provenance":"source"}],"advisories":[{"id":"GHSA-45rg-g72w-r393","url":"https://github.com/advisories/GHSA-45rg-g72w-r393","severity":"HIGH","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":[">=1.643, <1.650"],"patched":["1.650"],"provenance":"source","from":"GHSA"},{"id":"GHSA-45rg-g72w-r393","url":"https://github.com/advisories/GHSA-45rg-g72w-r393","severity":"HIGH","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":["<1.642.2"],"patched":["1.642.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2016-0803","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-0803","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":42394,"url":"https://www.exploit-db.com/exploits/42394","title":"Jenkins < 1.650 - Java Deserialization","type":"remote","platform":"java","date":"2017-07-30","verified":true,"provenance":"source"},{"id":43375,"url":"https://www.exploit-db.com/exploits/43375","title":"Jenkins - XStream Groovy classpath Deserialization (Metasploit)","type":"remote","platform":"multiple","date":"2017-12-19","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2017-07-30"},"pocGithub":{"count":2,"skipped":0,"earliest":"2017-07-30","earliestUrl":"https://github.com/jpiechowka/jenkins-cve-2016-0792","repos":[{"name":"jpiechowka/jenkins-cve-2016-0792","url":"https://github.com/jpiechowka/jenkins-cve-2016-0792","stars":47,"created":"2017-07-30"},{"name":"Aviksaikat/CVE-2016-0792","url":"https://github.com/Aviksaikat/CVE-2016-0792","stars":1,"created":"2021-09-07"}]},"metasploit":[{"name":"Jenkins XStream Groovy classpath Deserialization Vulnerability","module":"exploit/multi/http/jenkins_xstream_deserialize","type":"exploit","disclosureDate":"2016-02-24","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_xstream_deserialize.rb"}],"first":{"date":"2016-02-24","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_xstream_deserialize.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/43375/","https://www.exploit-db.com/exploits/42394/","https://www.exploit-db.com/exploits/42394","https://www.exploit-db.com/exploits/43375"],"flow":[],"timeline":[{"date":"2016-02-24","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2017-07-30, PoC-in-GitHub 2017-07-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_xstream_deserialize.rb","provenance":"source"},{"date":"2016-04-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2016-0792","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9968"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 2 advisory exploit references; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}