CVE-2017-1000353
100Vexday Risk Score
Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.
ssvc Actcvss 9.8epss 100%
da publicação à arma0 dias
Publicada no NVD29 de jan.
1ª PoC5 de mai.
metasploit26 de abr.
CISA KEV+2803d
probabilidade de exploração
100%top 1% das CVEs
exploração observada
simCISA + VulnCheck
7 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2025-10-23
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Versões
Afetadas
maven/org.jenkins-ci.main:jenkins-core >= 2.50, <= 2.56; maven/org.jenkins-ci.main:jenkins-core <= 2.46.1
Corrigidas em
maven/org.jenkins-ci.main:jenkins-core 2.57; maven/org.jenkins-ci.main:jenkins-core 2.46.2
Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
n/a · n/aPoCs públicas encontradas — 7
exploitdbwww.exploit-db.com/exploits/41965não verificadogithubgithub.com/vulhub/CVE-2017-1000353★ 57githubgithub.com/r00t4dm/Jenkins-CVE-2017-1000353★ 3cve_referencepacketstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.htmlnão verificadocve_referencewww.exploit-db.com/exploits/41965/não verificadovulncheckvulncheck.com/xdb/b3a083a5a7fanão verificadovulncheckvulncheck.com/xdb/995894c2f1a6não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.htmlhttps://jenkins.io/security/advisory/2017-04-26/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000353https://www.exploit-db.com/exploits/41965/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttp://www.securityfocus.com/bid/98056