CVE-2016-0792: jenkins Improper Input Validation
Vulnerability summary
CVE-2016-0792 is a high (CVSS 9.0) Improper Input Validation vulnerability in jenkins. EPSS estimates a 83.26% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 4 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 07-04-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
83.26%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 83.26% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (contrastsecurity.com)
Maturity: unknown
Jenkins < 1.650 - Java Deserialization
Maturity: weaponized
Jenkins - XStream Groovy classpath Deserialization (Metasploit)
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Jenkins1 product
- jenkins≤ 1.649 | ≤ 1.642.1
Mageia1 product
- jenkins-remoting< 2.53.3-1.mga5
Org.jenkins-ci.main1 product
- jenkins-core≥ 1.643, < 1.650 | < 1.642.2
Redhat1 product
- openshift3.1
4 vendors · 4 products
References
14 links- www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstreamX Refsource MISCExploitWEB
- wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24X Refsource CONFIRMPatchVendor AdvisoryWEB
