CveMateVulnerability intelligence

CVE-2015-8103: jenkins Deserialization of Untrusted Data

CVSS: 9.8v3.1CriticalModified

AliasesMGASA-2016-0137GHSA-wfw7-6632-xcv2

Published 25-11-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-8103 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in jenkins. EPSS estimates a 86.71% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 7 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

86.71%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits7reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 2

RHSA-2016:0070 RHSA-2016:0489

Timeline

25-11-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".

CVSS metrics

3 scores · 2 sources · 2 versions

v3.19.8v2.07.5

EPSS trend

Probability

86.71%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 86.71% on 18-09-2026

18-09-202618-10-2026

EPSS score

86.71%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

7 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (jenkins-ci.org)
Maturity: unknown
referenceUnverified
Exploit Reference (foxglovesecurity.com)
Maturity: unknown

Show all 7 exploits

exploit-databaseremotejavaVerified
Jenkins CLI - RMI Java Deserialization (Metasploit)
Maturity: weaponized
MetasploitremoteUnverified
Jenkins-CI Unauthenticated Script-Console Scanner
auxiliary/scanner/http/jenkins_command
Maturity: poc
MetasploitremoteVerified
Jenkins CLI RMI Java Deserialization Vulnerability
exploit/linux/misc/jenkins_java_deserialize
Maturity: weaponized
MetasploitremoteUnverified
OpenNMS Java Object Unserialization Remote Code Execution
exploit/linux/misc/opennms_java_serialize
Maturity: poc

Weaknesses

CWE · root cause

CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected systems

Jenkins1 product

jenkins< 1.625.2 | < 1.638

Mageia1 product

apache-commons-collections< 3.2.2-1.mga5

Org.jenkins-ci.main1 product

cli< 1.625.2 | ≥ 1.626, < 1.638

Redhat1 product

openshift_container_platform2.2 | 3.1

4 vendors · 4 products

References

21 links

packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.htmlX Refsource MISCExploitThird Party AdvisoryVDB EntryWEB
jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cliX Refsource CONFIRMExploitWEB
www.openwall.com/lists/oss-security/2015/11/18/13Mailing ListX Refsource MLISTWEB
rhn.redhat.com/errata/RHSA-2016-0489.htmlVendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
www.securityfocus.com/bid/77636VDB EntryX Refsource BIDBroken Link
www.openwall.com/lists/oss-security/2015/11/18/11Mailing ListX Refsource MLISTWEB
access.redhat.com/errata/RHSA-2016:0070Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
www.exploit-db.com/exploits/38983/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
foxglovesecurity.com/2015/…X Refsource MISCExploitWEB
www.openwall.com/lists/oss-security/2015/11/09/5Mailing ListX Refsource MLISTWEB

Show all 21 references

wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11X Refsource CONFIRMVendor AdvisoryWEB
www.openwall.com/lists/oss-security/2015/11/18/2Mailing ListX Refsource MLISTWEB
advisories.mageia.org/MGASA-2016-0137.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=18123REPORT
lists.fedoraproject.org/pipermail/package-announce/2016-April/181046.htmlWEB
nvd.nist.gov/vuln/detail/CVE-2015-8103Advisory
github.com/jenkinsci/jenkins/commit/5bd9b55a2a3249939fd78c501b8959a804c1164bWEB
github.com/jenkinsci/jenkins/commit/b4193d1132089286ebeaf9d8872c839ad473329cWEB
github.com/jenkinsci/jenkinsPACKAGE
web.archive.org/web/20151225025917/http://www.securityfocus.com/bid/77636WEB
www.exploit-db.com/exploits/38983WEB