CVE-2015-8103
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
- Affected products
- Jenkins, Commons-Collections
- Redhat Openshift Container Platform
- = 2.2, 3.1
- Fix
- Available
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 86.7% (100th percentile)
- Weakness
- CWE-502
- NVD status
- Modified
- Published
- 2015-11-25
CVE-2015-8103 at NVD
14 known exploits for CVE-2015-8103
Proof-of-concept code and exploit modules indexed by Sploitus
pwn_jenkins
Jenkins-CVE-2015-8103
cve-2015-8103
Exploit for Deserialization of Untrusted Data in Ibm Sterling_B2B_Integrator
Jenkins-CI Unauthenticated Script-Console Scanner
Exploit for Deserialization of Untrusted Data in Redhat Data_Grid
Exploit for Deserialization of Untrusted Data in Redhat Data_Grid
Jenkins CLI RMI Java Deserialization Exploit
Jenkins CLI - RMI Java Deserialization (Metasploit)
Jenkins CLI RMI Java Deserialization
Immunity Canvas: JENKINS_CLI_DESERIALIZATION
Jenkins CLI RMI Java Deserialization Vulnerability
OpenNMS Java Object Unserialization Remote Code Execution
Jenkins-CI Unauthenticated Script-Console Scanner