CVE-2015-8103
CriticalPublic exploitJenkins CLI Deserialization of Untrusted Data vulnerability
Published May 13, 2022 · Updated Aug 6, 2024 · Also known as GHSA-wfw7-6632-xcv2
Key Facts
Patch immediately- CVE-2015-8103 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Jenkins, Openshift Container Platform (Redhat), org.jenkins-ci.main:cli (maven) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 87% probability of exploitation in the next 30 days.
- Fixed versions are available, including activemq 0:5.9.0-6.redhat.611454.el6op, atomic-openshift 0:3.1.1.6-1.git.0.b57e8bd.el7aos, heapster 0:0.18.2-3.gitaf4752e.el7aos.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
87%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2015-8103 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Affected Products
141 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| JenkinsJenkins | See advisory | 1.638 |
| Openshift Container PlatformRedhat | 2.2, 3.1 | n/a |
| org.jenkins-ci.main:climaven | See advisory | 1.638 |
| activemqredhat | See advisory | 0:5.9.0-6.redhat.611454.el6op |
| atomic-openshiftredhat | See advisory | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
Patched Releases
activemq
0:5.9.0-6.redhat.611454.el6op
atomic-openshift
0:3.1.1.6-1.git.0.b57e8bd.el7aos
heapster
0:0.18.2-3.gitaf4752e.el7aos
Jenkins
0:1.625.3-1.el6op, 0:1.625.3-2.el7aos, 1.625.2, 1.638
nodejs-align-text
0:0.1.3-2.el7aos
nodejs-ansi-green
0:0.1.1-1.el7aos
nodejs-ansi-wrap
0:0.1.0-1.el7aos
nodejs-anymatch
0:1.3.0-1.el7aos
nodejs-arr-diff
0:2.0.0-1.el7aos
nodejs-arr-flatten
0:1.0.1-1.el7aos
nodejs-array-unique
0:0.2.1-1.el7aos
nodejs-arrify
0:1.0.0-1.el7aos
nodejs-async-each
0:1.0.0-1.el7aos
nodejs-binary-extensions
0:1.3.1-1.el7aos
nodejs-braces
0:1.8.2-2.el7aos
nodejs-capture-stack-trace
0:1.0.0-2.el7aos
nodejs-chokidar
0:1.4.1-2.el7aos
nodejs-configstore
0:1.4.0-1.el7aos
nodejs-create-error-class
0:2.0.1-2.el7aos
nodejs-deep-extend
0:0.3.2-2.el7aos
nodejs-duplexer
0:0.1.1-2.el7aos
nodejs-duplexify
0:3.4.2-1.el7aos
nodejs-end-of-stream
0:1.1.0-2.el7aos
nodejs-error-ex
0:1.2.0-1.el7aos
nodejs-es6-promise
0:3.0.2-2.el7aos
Timeline
Publicly disclosed
May 13, 2022
Last updated
Aug 6, 2024
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
- advisoryRHSA-2016:0489
- advisoryGHSA advisory
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2015-8103
- exploitMSF jenkins_java_deserialize.rb
- exploitMSF opennms_java_serialize.rb
FAQ
Common Questions.
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Affected: Jenkins; Openshift Container Platform (Redhat) versions 2.2, 3.1; org.jenkins-ci.main:cli (maven), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including activemq 0:5.9.0-6.redhat.611454.el6op, atomic-openshift 0:3.1.1.6-1.git.0.b57e8bd.el7aos, heapster 0:0.18.2-3.gitaf4752e.el7aos.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2015-8103 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo