Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Jenkins Remoting Module Allows Remote Code Execution

CVE-2016-0788 · published 10 years ago
Summary

The Jenkins Remoting module has a security weakness that allows hackers to take control of a server by opening a special connection. This could potentially let them execute malicious code on the server. Update to the latest version of Jenkins to fix this issue.

What to do
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 1.650.
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 1.642.2.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.main:jenkins-core >= 1.643, < 1.650
< 1.642.2
Fix: upgrade to 1.650
– jenkins jenkins 1.642.1
<= 1.649
cpe:2.3:a:jenkins:jenkins:1.642.1:*:*:*:lts:*:*:*
– redhat openshift 3.1
cpe:2.3:a:redhat:openshift:3.1:*:*:*:enterprise:*:*:*
Original advisory text
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
12% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published7 Apr 2016
Updated15 Oct 2026
First seen6 Mar 2026
Sources
GHSA-j7q5-h445-f7pc · GHSA
CVE-2016-0788 · NVD
Track software like this
Free during beta