Lucene search

Veracode Vulnerability DatabaseVERACODE:16660

HistoryMay 02, 2019 - 5:21 a.m.

Command Injection

2019-05-0205:21:37

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Jenkins is vulnerable to command injection. The attack exists because it allows an injection of serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the “Groovy variant in ‘ysoserial’”.

CPENameOperatorVersion
nodejs-spliteq0.3.3__1.el7
nodejs-slideeq1.1.5__1.el7
nodejs-througheq2.3.4__2.el7
nodejs-goteq2.2.0__3.el7
nodejs-align-texteq0.1.3__1.el7aos
nodejs-is-streameq1.0.1__1.el7
nodejs-graceful-fseq2.0.0__2.el7
nodejs-rceq0.5.4__2.el7
nodejs-registry-urleq2.0.0__3.el7
nodejs-kind-ofeq2.0.1__1.el7aos

Name	Operator	Version
nodejs-split	eq	0.3.3__1.el7
nodejs-slide	eq	1.1.5__1.el7
nodejs-through	eq	2.3.4__2.el7
nodejs-got	eq	2.2.0__3.el7
nodejs-align-text	eq	0.1.3__1.el7aos
nodejs-is-stream	eq	1.0.1__1.el7
nodejs-graceful-fs	eq	2.0.0__2.el7
nodejs-rc	eq	0.5.4__2.el7
nodejs-registry-url	eq	2.0.0__3.el7
nodejs-kind-of	eq	2.0.1__1.el7aos

Rows per page:

1-10 of 3811

References

foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#jenkins

packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.html

rhn.redhat.com/errata/RHSA-2016-0489.html

www.openwall.com/lists/oss-security/2015/11/09/5

www.openwall.com/lists/oss-security/2015/11/18/11

www.openwall.com/lists/oss-security/2015/11/18/13

www.openwall.com/lists/oss-security/2015/11/18/2

www.securityfocus.com/bid/77636

access.redhat.com/errata/RHSA-2016:0070

access.redhat.com/security/updates/classification/#important

bugzilla.redhat.com/show_bug.cgi?id=1243514

bugzilla.redhat.com/show_bug.cgi?id=1247523

bugzilla.redhat.com/show_bug.cgi?id=1254880

bugzilla.redhat.com/show_bug.cgi?id=1256869

bugzilla.redhat.com/show_bug.cgi?id=1268478

bugzilla.redhat.com/show_bug.cgi?id=1273739

bugzilla.redhat.com/show_bug.cgi?id=1277329

bugzilla.redhat.com/show_bug.cgi?id=1277383

bugzilla.redhat.com/show_bug.cgi?id=1277608

bugzilla.redhat.com/show_bug.cgi?id=1278232

bugzilla.redhat.com/show_bug.cgi?id=1278630

bugzilla.redhat.com/show_bug.cgi?id=1279404

bugzilla.redhat.com/show_bug.cgi?id=1279744

bugzilla.redhat.com/show_bug.cgi?id=1279925

bugzilla.redhat.com/show_bug.cgi?id=1280216

bugzilla.redhat.com/show_bug.cgi?id=1280497

bugzilla.redhat.com/show_bug.cgi?id=1282426

bugzilla.redhat.com/show_bug.cgi?id=1282738

bugzilla.redhat.com/show_bug.cgi?id=1283952

bugzilla.redhat.com/show_bug.cgi?id=1284506

bugzilla.redhat.com/show_bug.cgi?id=1287414

bugzilla.redhat.com/show_bug.cgi?id=1287943

bugzilla.redhat.com/show_bug.cgi?id=1288014

bugzilla.redhat.com/show_bug.cgi?id=1289603

bugzilla.redhat.com/show_bug.cgi?id=1289965

bugzilla.redhat.com/show_bug.cgi?id=1290643

bugzilla.redhat.com/show_bug.cgi?id=1290967

bugzilla.redhat.com/show_bug.cgi?id=1292621

bugzilla.redhat.com/show_bug.cgi?id=1293251

bugzilla.redhat.com/show_bug.cgi?id=1293252

bugzilla.redhat.com/show_bug.cgi?id=1293829

bugzilla.redhat.com/show_bug.cgi?id=1293877

bugzilla.redhat.com/show_bug.cgi?id=1294115

bugzilla.redhat.com/show_bug.cgi?id=1294798

bugzilla.redhat.com/show_bug.cgi?id=1296457

jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli

rhn.redhat.com/errata/RHSA-2016-0070.html

wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

www.exploit-db.com/exploits/38983/

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Related for VERACODE:16660