Test ID:	1.3.6.1.4.1.25623.1.0.107230
Category:	Web application abuses
Title:	Jenkins Deserialization Vulnerability (CVE-2016-0792) - Active Check
Summary:	Jenkins is prone to a Java deserialization vulnerability.
Description:	Summary: Jenkins is prone to a Java deserialization vulnerability. Vulnerability Insight: Multiple unspecified API endpoints in Jenkins allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando. Vulnerability Impact: Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Affected Software/OS: All Jenkins main line releases up to and including 1.649, All Jenkins LTS releases up to and including 1.642.1. Solution: Jenkins main line users should update to 1.650, Jenkins LTS users should update to 1.642.2. CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-0792 https://www.exploit-db.com/exploits/42394/ https://www.exploit-db.com/exploits/43375/ https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream RedHat Security Advisories: RHSA-2016:0711 https://access.redhat.com/errata/RHSA-2016:0711 RedHat Security Advisories: RHSA-2016:1773 http://rhn.redhat.com/errata/RHSA-2016-1773.html
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.