CVE-2017-1000353

🗓️ 29 Jan 2018 17:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 360 Views🌐 WEB

Jenkins versions 2.56 and earlier vulnerable to unauthenticated remote code executio

Reporter	Title	Published	Views	Family All 67
Gitee	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab	17 Jul 202015:40	–	gitee
Gitee	Exploit for Improper Encoding or Escaping of Output in F5 Nginx	19 Sep 202123:39	–	gitee
Gitee	Exploit for Improper Encoding or Escaping of Output in F5 Nginx	1 May 202300:00	–	gitee
Gitee	Exploit for Improper Encoding or Escaping of Output in F5 Nginx	18 Jun 202015:22	–	gitee
Gitee	Exploit for Improper Encoding or Escaping of Output in F5 Nginx	24 Nov 202100:17	–	gitee
Gitee	Exploit for Improper Encoding or Escaping of Output in F5 Nginx	3 Aug 201809:28	–	gitee
Gitee	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab	11 Oct 201900:03	–	gitee
Gitee	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab	8 Apr 202014:01	–	gitee
Gitee	Exploit for Improper Encoding or Escaping of Output in F5 Nginx	4 Feb 202013:43	–	gitee
Gitee	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab	18 Jan 202112:31	–	gitee

NVD

Node

Node

jenkins jenkinsRange≤2.46.1lts

Node

Source	Link
jenkins	www.jenkins.io/security/advisory/2017-04-26/
securityfocus	www.securityfocus.com/bid/98056
oracle	www.oracle.com/security-alerts/cpuapr2022.html
packetstormsecurity	www.packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html
exploit-db	www.exploit-db.com/exploits/41965/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
Session	request body	192.168.18.161:8080/cli	Java deserialization vulnerability via Jenkins CLI remoting; PoC uses a serialized payload sent to the /cli endpoint to trigger RCE (CVE-2017-1000353).	CWE-502
Side	request body	192.168.18.161:8080/cli	Java deserialization vulnerability via Jenkins CLI remoting; PoC uses a serialized payload sent to the /cli endpoint to trigger RCE (CVE-2017-1000353).	CWE-502

05 Nov 2025 19:24Current

9.7High risk

Vulners AI Score9.7

CVSS 27.5

CVSS 3.19.8

EPSS0.94479

SSVC