CVE-2017-1000353: Jenkins Remote Code Execution Vulnerability

Vereiste actie (tekst van CISA, Engels)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Beschrijving (NVD, Engels)

Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.

BRONNEN

• CISA KEVCISA Known Exploited Vulnerabilities catalog

Andere lekken bij Jenkins

• CVE-2024-23897: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
• CVE-2015-5317: Jenkins User Interface (UI) Information Disclosure Vulnerability
• CVE-2019-1003029: Jenkins Script Security Plugin Sandbox Bypass Vulnerability
• CVE-2019-1003030: Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
• CVE-2018-1000861: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.