Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Jenkins Remoting Module Allows Remote Code Execution via Malicious Data

CVE-2016-9299 · published 9 years ago
Summary

Jenkins versions before 2.32 and LTS versions before 2.19.3 are vulnerable to a security threat. An attacker can send malicious data to Jenkins, which can then be used to execute arbitrary code on the server. Update to the latest version to fix the issue.

What to do
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.32.
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.19.3.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.main:jenkins-core >= 2.20, <= 2.31
<= 2.19.2
Fix: upgrade to 2.32
– jenkins jenkins <= 2.19.2
<= 2.31
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
– fedoraproject fedora 25
cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
Original advisory text
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-part...
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
97% chance of attack within 30 days
Type
CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Timeline
Published12 Jan 2017
Updated22 Sep 2026
First seen6 Mar 2026
Sources
GHSA-2x9h-h3c4-wqqh · GHSA
CVE-2016-9299 · NVD
Track software like this
Free during beta