CVE-2015-8103: Command Injection
The following flaw was found in Jenkins:
Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master.
This flaw could allow unauthenticated remote attackers to run arbitrary code on Jenkins.
Mitigation:
https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
Other sources
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-.jar file and the "Groovy variant in ysoserial".
— GitHub
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-.jar file and the "Groovy variant in 'ysoserial'".
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8103?
CVE-2015-8103 has a critical severity level due to the potential for unauthenticated remote code execution.
How do I fix CVE-2015-8103?
To fix CVE-2015-8103, upgrade Jenkins to version 1.638 or 1.625.2, depending on your current version.
What types of attacks can exploit CVE-2015-8103?
CVE-2015-8103 can be exploited by unauthenticated remote attackers to execute arbitrary code on the Jenkins master.
Which versions of Jenkins are affected by CVE-2015-8103?
Versions of Jenkins prior to 1.638 and 1.625.2 are affected by CVE-2015-8103.
Is there a workaround for CVE-2015-8103 before upgrading?
There is no officially documented workaround for CVE-2015-8103; upgrading is the recommended mitigation.