CVE-2015-8103

CVE-2015-8103

Published · Updated

Follow this CVE+ Monitor org.jenkins-ci.main:cli

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 92%
from disclosure to weapon20 days
Published on NVDNov 25
1st PoC+20d
metasploitNov 6
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
4 products (310 components)
Red Hat OpenShift Enterprise 3.1 · Red Hat OpenShift Enterprise Node 2.2 · Red Hat OpenShift Enterprise Infrastructure 2.2 · Red Hat OpenShift Enterprise Client 2.2
fix ↗
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.