CVE-2015-8103
Jenkins CLI Deserialization of Untrusted Data vulnerability
9.8 CriticalPublic exploitFix available
CVE-2015-8103 is a critical vulnerability (CVSS 9.8) in Jenkins, published November 25, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 91.9%, the 99th percentile. Fixed in org.jenkins-ci.main:cli 1.625.2.
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
91.9%Down 2.3 points since Feb 4, 2022
What each source reports
NVD Score used
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
- Record
CVE-2015-8103- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
- Record
CVE-2015-8103- Updated
- 2026-11-02
EUVDEUVD-2022-5567 No score
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
- Record
EUVD-2022-5567- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wfw7-6632-xcv2
Jenkins CLI Deserialization of Untrusted Data vulnerability
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in ysoserial".
- Record
GHSA-wfw7-6632-xcv2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVGHSA-wfw7-6632-xcv2
Jenkins CLI Deserialization of Untrusted Data vulnerability
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in ysoserial".
- Record
GHSA-wfw7-6632-xcv2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVMGASA-2016-0137 No score
Updated apache-commons-collections packages fix CVE-2015-8103
Updated apache-commons-collections packages fix security vulnerability:
Due to an issue with serialization, Java applications can be vulnerable to malicious remote code execution when the apache-commons-collections library is on the classpath (CVE-2015-8103).
- Record
MGASA-2016-0137- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:cliMaven |
before 1.625.2 | 1.625.2 |
org.jenkins-ci.main:cliMaven |
1.626 up to 1.638 | 1.638 |
org.jenkins-ci.main:cliMaven |
before 1.625.2, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
1.625.2 |
org.jenkins-ci.main:cliMaven |
1.626 up to 1.638, plus listed versions 1.6271.6281.6291.6301.631 Show 6 moreShow less1.6321.6331.6341.6351.6361.637 |
1.638 |
apache-commons-collectionsMageia:5 |
before 3.2.2-1.mga5 | 3.2.2-1.mga5 |
atomic-openshiftRed Hat:openshift:3.1::el7 |
before 0:3.1.1.6-1.git.0.b57e8bd.el7aos | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
atomic-openshift-clientsRed Hat:openshift:3.1::el7 |
before 0:3.1.1.6-1.git.0.b57e8bd.el7aos | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
atomic-openshift-clients-redistributableRed Hat:openshift:3.1::el7 |
before 0:3.1.1.6-1.git.0.b57e8bd.el7aos | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
atomic-openshift-dockerregistryRed Hat:openshift:3.1::el7 |
before 0:3.1.1.6-1.git.0.b57e8bd.el7aos | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
atomic-openshift-masterRed Hat:openshift:3.1::el7 |
before 0:3.1.1.6-1.git.0.b57e8bd.el7aos | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
Show 164 moreShow less
| Package | Affected | Fixed |
|---|---|---|
atomic-openshift-nodeRed Hat:openshift:3.1::el7 |
before 0:3.1.1.6-1.git.0.b57e8bd.el7aos | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
atomic-openshift-podRed Hat:openshift:3.1::el7 |
before 0:3.1.1.6-1.git.0.b57e8bd.el7aos | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
atomic-openshift-recycleRed Hat:openshift:3.1::el7 |
before 0:3.1.1.6-1.git.0.b57e8bd.el7aos | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
atomic-openshift-sdn-ovsRed Hat:openshift:3.1::el7 |
before 0:3.1.1.6-1.git.0.b57e8bd.el7aos | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
atomic-openshift-utilsRed Hat:openshift:3.1::el7 |
before 0:3.0.35-1.git.0.6a386dd.el7aos | 0:3.0.35-1.git.0.6a386dd.el7aos |
heapsterRed Hat:openshift:3.1::el7 |
before 0:0.18.2-3.gitaf4752e.el7aos | 0:0.18.2-3.gitaf4752e.el7aos |
jenkinsRed Hat:openshift:3.1::el7 |
before 0:1.625.3-2.el7aos | 0:1.625.3-2.el7aos |
nodejs-align-textRed Hat:openshift:3.1::el7 |
before 0:0.1.3-2.el7aos | 0:0.1.3-2.el7aos |
nodejs-ansi-greenRed Hat:openshift:3.1::el7 |
before 0:0.1.1-1.el7aos | 0:0.1.1-1.el7aos |
nodejs-ansi-wrapRed Hat:openshift:3.1::el7 |
before 0:0.1.0-1.el7aos | 0:0.1.0-1.el7aos |
nodejs-anymatchRed Hat:openshift:3.1::el7 |
before 0:1.3.0-1.el7aos | 0:1.3.0-1.el7aos |
nodejs-arr-diffRed Hat:openshift:3.1::el7 |
before 0:2.0.0-1.el7aos | 0:2.0.0-1.el7aos |
nodejs-arr-flattenRed Hat:openshift:3.1::el7 |
before 0:1.0.1-1.el7aos | 0:1.0.1-1.el7aos |
nodejs-array-uniqueRed Hat:openshift:3.1::el7 |
before 0:0.2.1-1.el7aos | 0:0.2.1-1.el7aos |
nodejs-arrifyRed Hat:openshift:3.1::el7 |
before 0:1.0.0-1.el7aos | 0:1.0.0-1.el7aos |
nodejs-async-eachRed Hat:openshift:3.1::el7 |
before 0:1.0.0-1.el7aos | 0:1.0.0-1.el7aos |
nodejs-binary-extensionsRed Hat:openshift:3.1::el7 |
before 0:1.3.1-1.el7aos | 0:1.3.1-1.el7aos |
nodejs-bracesRed Hat:openshift:3.1::el7 |
before 0:1.8.2-2.el7aos | 0:1.8.2-2.el7aos |
nodejs-capture-stack-traceRed Hat:openshift:3.1::el7 |
before 0:1.0.0-2.el7aos | 0:1.0.0-2.el7aos |
nodejs-chokidarRed Hat:openshift:3.1::el7 |
before 0:1.4.1-2.el7aos | 0:1.4.1-2.el7aos |
nodejs-configstoreRed Hat:openshift:3.1::el7 |
before 0:1.4.0-1.el7aos | 0:1.4.0-1.el7aos |
nodejs-create-error-classRed Hat:openshift:3.1::el7 |
before 0:2.0.1-2.el7aos | 0:2.0.1-2.el7aos |
nodejs-deep-extendRed Hat:openshift:3.1::el7 |
before 0:0.3.2-2.el7aos | 0:0.3.2-2.el7aos |
nodejs-duplexerRed Hat:openshift:3.1::el7 |
before 0:0.1.1-2.el7aos | 0:0.1.1-2.el7aos |
nodejs-duplexifyRed Hat:openshift:3.1::el7 |
before 0:3.4.2-1.el7aos | 0:3.4.2-1.el7aos |
nodejs-end-of-streamRed Hat:openshift:3.1::el7 |
before 0:1.1.0-2.el7aos | 0:1.1.0-2.el7aos |
nodejs-error-exRed Hat:openshift:3.1::el7 |
before 0:1.2.0-1.el7aos | 0:1.2.0-1.el7aos |
nodejs-es6-promiseRed Hat:openshift:3.1::el7 |
before 0:3.0.2-2.el7aos | 0:3.0.2-2.el7aos |
nodejs-event-streamRed Hat:openshift:3.1::el7 |
before 0:3.3.2-1.el7aos | 0:3.3.2-1.el7aos |
nodejs-expand-bracketsRed Hat:openshift:3.1::el7 |
before 0:0.1.4-1.el7aos | 0:0.1.4-1.el7aos |
nodejs-expand-rangeRed Hat:openshift:3.1::el7 |
before 0:1.8.1-1.el7aos | 0:1.8.1-1.el7aos |
nodejs-extglobRed Hat:openshift:3.1::el7 |
before 0:0.3.1-1.el7aos | 0:0.3.1-1.el7aos |
nodejs-filename-regexRed Hat:openshift:3.1::el7 |
before 0:2.0.0-1.el7aos | 0:2.0.0-1.el7aos |
nodejs-fill-rangeRed Hat:openshift:3.1::el7 |
before 0:2.2.3-1.el7aos | 0:2.2.3-1.el7aos |
nodejs-for-inRed Hat:openshift:3.1::el7 |
before 0:0.1.4-1.el7aos | 0:0.1.4-1.el7aos |
nodejs-for-ownRed Hat:openshift:3.1::el7 |
before 0:0.1.3-1.el7aos | 0:0.1.3-1.el7aos |
nodejs-fromRed Hat:openshift:3.1::el7 |
before 0:0.1.3-2.el7aos | 0:0.1.3-2.el7aos |
nodejs-glob-baseRed Hat:openshift:3.1::el7 |
before 0:0.3.0-1.el7aos | 0:0.3.0-1.el7aos |
nodejs-glob-parentRed Hat:openshift:3.1::el7 |
before 0:2.0.0-1.el7aos | 0:2.0.0-1.el7aos |
nodejs-gotRed Hat:openshift:3.1::el7 |
before 0:5.2.1-1.el7aos | 0:5.2.1-1.el7aos |
nodejs-graceful-fsRed Hat:openshift:3.1::el7 |
before 0:4.1.2-1.el7aos | 0:4.1.2-1.el7aos |
nodejs-iniRed Hat:openshift:3.1::el7 |
before 0:1.1.0-6.el7aos | 0:1.1.0-6.el7aos |
nodejs-is-binary-pathRed Hat:openshift:3.1::el7 |
before 0:1.0.1-1.el7aos | 0:1.0.1-1.el7aos |
nodejs-is-dotfileRed Hat:openshift:3.1::el7 |
before 0:1.0.2-1.el7aos | 0:1.0.2-1.el7aos |
nodejs-is-equal-shallowRed Hat:openshift:3.1::el7 |
before 0:0.1.3-1.el7aos | 0:0.1.3-1.el7aos |
nodejs-is-extendableRed Hat:openshift:3.1::el7 |
before 0:0.1.1-1.el7aos | 0:0.1.1-1.el7aos |
nodejs-is-extglobRed Hat:openshift:3.1::el7 |
before 0:1.0.0-1.el7aos | 0:1.0.0-1.el7aos |
nodejs-is-globRed Hat:openshift:3.1::el7 |
before 0:2.0.1-1.el7aos | 0:2.0.1-1.el7aos |
nodejs-is-npmRed Hat:openshift:3.1::el7 |
before 0:1.0.0-1.el7aos | 0:1.0.0-1.el7aos |
nodejs-is-numberRed Hat:openshift:3.1::el7 |
before 0:2.1.0-1.el7aos | 0:2.1.0-1.el7aos |
nodejs-is-plain-objRed Hat:openshift:3.1::el7 |
before 0:1.0.0-1.el7aos | 0:1.0.0-1.el7aos |
nodejs-is-primitiveRed Hat:openshift:3.1::el7 |
before 0:2.0.0-1.el7aos | 0:2.0.0-1.el7aos |
nodejs-is-redirectRed Hat:openshift:3.1::el7 |
before 0:1.0.0-1.el7aos | 0:1.0.0-1.el7aos |
nodejs-is-streamRed Hat:openshift:3.1::el7 |
before 0:1.0.1-2.el7aos | 0:1.0.1-2.el7aos |
nodejs-isobjectRed Hat:openshift:3.1::el7 |
before 0:2.0.0-1.el7aos | 0:2.0.0-1.el7aos |
nodejs-kind-ofRed Hat:openshift:3.1::el7 |
before 0:3.0.2-1.el7aos | 0:3.0.2-1.el7aos |
nodejs-latest-versionRed Hat:openshift:3.1::el7 |
before 0:2.0.0-1.el7aos | 0:2.0.0-1.el7aos |
nodejs-lazy-cacheRed Hat:openshift:3.1::el7 |
before 0:1.0.2-1.el7aos | 0:1.0.2-1.el7aos |
nodejs-lodash.assignRed Hat:openshift:3.1::el7 |
before 0:3.2.0-1.el7aos | 0:3.2.0-1.el7aos |
nodejs-lodash.baseassignRed Hat:openshift:3.1::el7 |
before 0:3.2.0-1.el7aos | 0:3.2.0-1.el7aos |
nodejs-lodash.basecopyRed Hat:openshift:3.1::el7 |
before 0:3.0.1-1.el7aos | 0:3.0.1-1.el7aos |
nodejs-lodash.bindcallbackRed Hat:openshift:3.1::el7 |
before 0:3.0.1-1.el7aos | 0:3.0.1-1.el7aos |
nodejs-lodash.createassignerRed Hat:openshift:3.1::el7 |
before 0:3.1.1-1.el7aos | 0:3.1.1-1.el7aos |
nodejs-lodash.defaultsRed Hat:openshift:3.1::el7 |
before 0:3.1.2-1.el7aos | 0:3.1.2-1.el7aos |
nodejs-lodash.getnativeRed Hat:openshift:3.1::el7 |
before 0:3.9.1-1.el7aos | 0:3.9.1-1.el7aos |
nodejs-lodash.isargumentsRed Hat:openshift:3.1::el7 |
before 0:3.0.4-1.el7aos | 0:3.0.4-1.el7aos |
nodejs-lodash.isarrayRed Hat:openshift:3.1::el7 |
before 0:3.0.4-1.el7aos | 0:3.0.4-1.el7aos |
nodejs-lodash.isiterateecallRed Hat:openshift:3.1::el7 |
before 0:3.0.9-1.el7aos | 0:3.0.9-1.el7aos |
nodejs-lodash.keysRed Hat:openshift:3.1::el7 |
before 0:3.1.2-1.el7aos | 0:3.1.2-1.el7aos |
nodejs-lodash.restparamRed Hat:openshift:3.1::el7 |
before 0:3.6.1-1.el7aos | 0:3.6.1-1.el7aos |
nodejs-lowercase-keysRed Hat:openshift:3.1::el7 |
before 0:1.0.0-2.el7aos | 0:1.0.0-2.el7aos |
nodejs-map-streamRed Hat:openshift:3.1::el7 |
before 0:0.1.0-2.el7aos | 0:0.1.0-2.el7aos |
nodejs-micromatchRed Hat:openshift:3.1::el7 |
before 0:2.3.5-2.el7aos | 0:2.3.5-2.el7aos |
nodejs-mkdirpRed Hat:openshift:3.1::el7 |
before 0:0.5.0-2.el7aos | 0:0.5.0-2.el7aos |
nodejs-node-status-codesRed Hat:openshift:3.1::el7 |
before 0:1.0.0-1.el7aos | 0:1.0.0-1.el7aos |
nodejs-nodemonRed Hat:openshift:3.1::el7 |
before 0:1.8.1-2.el7aos | 0:1.8.1-2.el7aos |
nodejs-normalize-pathRed Hat:openshift:3.1::el7 |
before 0:2.0.1-1.el7aos | 0:2.0.1-1.el7aos |
nodejs-object-assignRed Hat:openshift:3.1::el7 |
before 0:4.0.1-1.el7aos | 0:4.0.1-1.el7aos |
nodejs-object.omitRed Hat:openshift:3.1::el7 |
before 0:2.0.0-1.el7aos | 0:2.0.0-1.el7aos |
nodejs-optimistRed Hat:openshift:3.1::el7 |
before 0:0.4.0-5.el7aos | 0:0.4.0-5.el7aos |
nodejs-os-homedirRed Hat:openshift:3.1::el7 |
before 0:1.0.1-1.el7aos | 0:1.0.1-1.el7aos |
nodejs-os-tmpdirRed Hat:openshift:3.1::el7 |
before 0:1.0.1-1.el7aos | 0:1.0.1-1.el7aos |
nodejs-osenvRed Hat:openshift:3.1::el7 |
before 0:0.1.0-2.el7aos | 0:0.1.0-2.el7aos |
nodejs-package-jsonRed Hat:openshift:3.1::el7 |
before 0:2.3.0-1.el7aos | 0:2.3.0-1.el7aos |
nodejs-parse-globRed Hat:openshift:3.1::el7 |
before 0:3.0.4-1.el7aos | 0:3.0.4-1.el7aos |
nodejs-parse-jsonRed Hat:openshift:3.1::el7 |
before 0:2.2.0-2.el7aos | 0:2.2.0-2.el7aos |
nodejs-pause-streamRed Hat:openshift:3.1::el7 |
before 0:0.0.11-2.el7aos | 0:0.0.11-2.el7aos |
nodejs-pinkieRed Hat:openshift:3.1::el7 |
before 0:2.0.1-1.el7aos | 0:2.0.1-1.el7aos |
nodejs-pinkie-promiseRed Hat:openshift:3.1::el7 |
before 0:2.0.0-1.el7aos | 0:2.0.0-1.el7aos |
nodejs-prepend-httpRed Hat:openshift:3.1::el7 |
before 0:1.0.1-2.el7aos | 0:1.0.1-2.el7aos |
nodejs-preserveRed Hat:openshift:3.1::el7 |
before 0:0.2.0-1.el7aos | 0:0.2.0-1.el7aos |
nodejs-ps-treeRed Hat:openshift:3.1::el7 |
before 0:1.0.1-1.el7aos | 0:1.0.1-1.el7aos |
nodejs-randomaticRed Hat:openshift:3.1::el7 |
before 0:1.1.5-1.el7aos | 0:1.1.5-1.el7aos |
nodejs-rcRed Hat:openshift:3.1::el7 |
before 0:1.1.2-1.el7aos | 0:1.1.2-1.el7aos |
nodejs-read-all-streamRed Hat:openshift:3.1::el7 |
before 0:3.0.1-3.el7aos | 0:3.0.1-3.el7aos |
nodejs-readdirpRed Hat:openshift:3.1::el7 |
before 0:2.0.0-2.el7aos | 0:2.0.0-2.el7aos |
nodejs-regex-cacheRed Hat:openshift:3.1::el7 |
before 0:0.4.2-1.el7aos | 0:0.4.2-1.el7aos |
nodejs-registry-urlRed Hat:openshift:3.1::el7 |
before 0:3.0.3-1.el7aos | 0:3.0.3-1.el7aos |
nodejs-repeat-elementRed Hat:openshift:3.1::el7 |
before 0:1.1.2-1.el7aos | 0:1.1.2-1.el7aos |
nodejs-semverRed Hat:openshift:3.1::el7 |
before 0:5.1.0-1.el7aos | 0:5.1.0-1.el7aos |
nodejs-semver-diffRed Hat:openshift:3.1::el7 |
before 0:2.1.0-1.el7aos | 0:2.1.0-1.el7aos |
nodejs-slideRed Hat:openshift:3.1::el7 |
before 0:1.1.5-3.el7aos | 0:1.1.5-3.el7aos |
nodejs-splitRed Hat:openshift:3.1::el7 |
before 0:0.3.3-2.el7aos | 0:0.3.3-2.el7aos |
nodejs-stream-combinerRed Hat:openshift:3.1::el7 |
before 0:0.2.1-2.el7aos | 0:0.2.1-2.el7aos |
nodejs-string-lengthRed Hat:openshift:3.1::el7 |
before 0:1.0.1-1.el7aos | 0:1.0.1-1.el7aos |
nodejs-strip-json-commentsRed Hat:openshift:3.1::el7 |
before 0:1.0.2-2.el7aos | 0:1.0.2-2.el7aos |
nodejs-success-symbolRed Hat:openshift:3.1::el7 |
before 0:0.1.0-1.el7aos | 0:0.1.0-1.el7aos |
nodejs-throughRed Hat:openshift:3.1::el7 |
before 0:2.3.4-4.el7aos | 0:2.3.4-4.el7aos |
nodejs-timed-outRed Hat:openshift:3.1::el7 |
before 0:2.0.0-3.el7aos | 0:2.0.0-3.el7aos |
nodejs-touchRed Hat:openshift:3.1::el7 |
before 0:1.0.0-2.el7aos | 0:1.0.0-2.el7aos |
nodejs-undefsafeRed Hat:openshift:3.1::el7 |
before 0:0.0.3-1.el7aos | 0:0.0.3-1.el7aos |
nodejs-unzip-responseRed Hat:openshift:3.1::el7 |
before 0:1.0.0-1.el7aos | 0:1.0.0-1.el7aos |
nodejs-update-notifierRed Hat:openshift:3.1::el7 |
before 0:0.6.0-1.el7aos | 0:0.6.0-1.el7aos |
nodejs-url-parse-laxRed Hat:openshift:3.1::el7 |
before 0:1.0.0-1.el7aos | 0:1.0.0-1.el7aos |
nodejs-uuidRed Hat:openshift:3.1::el7 |
before 0:2.0.1-1.el7aos | 0:2.0.1-1.el7aos |
nodejs-write-file-atomicRed Hat:openshift:3.1::el7 |
before 0:1.1.2-2.el7aos | 0:1.1.2-2.el7aos |
nodejs-xdg-basedirRed Hat:openshift:3.1::el7 |
before 0:2.0.0-1.el7aos | 0:2.0.0-1.el7aos |
nss_wrapperRed Hat:openshift:3.1::el7 |
before 0:1.0.3-1.el7 | 0:1.0.3-1.el7 |
nss_wrapper-debuginfoRed Hat:openshift:3.1::el7 |
before 0:1.0.3-1.el7 | 0:1.0.3-1.el7 |
openshift-ansibleRed Hat:openshift:3.1::el7 |
before 0:3.0.35-1.git.0.6a386dd.el7aos | 0:3.0.35-1.git.0.6a386dd.el7aos |
openshift-ansible-docsRed Hat:openshift:3.1::el7 |
before 0:3.0.35-1.git.0.6a386dd.el7aos | 0:3.0.35-1.git.0.6a386dd.el7aos |
openshift-ansible-filter-pluginsRed Hat:openshift:3.1::el7 |
before 0:3.0.35-1.git.0.6a386dd.el7aos | 0:3.0.35-1.git.0.6a386dd.el7aos |
openshift-ansible-lookup-pluginsRed Hat:openshift:3.1::el7 |
before 0:3.0.35-1.git.0.6a386dd.el7aos | 0:3.0.35-1.git.0.6a386dd.el7aos |
openshift-ansible-playbooksRed Hat:openshift:3.1::el7 |
before 0:3.0.35-1.git.0.6a386dd.el7aos | 0:3.0.35-1.git.0.6a386dd.el7aos |
openshift-ansible-rolesRed Hat:openshift:3.1::el7 |
before 0:3.0.35-1.git.0.6a386dd.el7aos | 0:3.0.35-1.git.0.6a386dd.el7aos |
openvswitchRed Hat:openshift:3.1::el7 |
before 0:2.4.0-1.el7 | 0:2.4.0-1.el7 |
openvswitch-debuginfoRed Hat:openshift:3.1::el7 |
before 0:2.4.0-1.el7 | 0:2.4.0-1.el7 |
openvswitch-develRed Hat:openshift:3.1::el7 |
before 0:2.4.0-1.el7 | 0:2.4.0-1.el7 |
openvswitch-testRed Hat:openshift:3.1::el7 |
before 0:2.4.0-1.el7 | 0:2.4.0-1.el7 |
origin-kibanaRed Hat:openshift:3.1::el7 |
before 0:0.5.0-1.el7aos | 0:0.5.0-1.el7aos |
python-openvswitchRed Hat:openshift:3.1::el7 |
before 0:2.4.0-1.el7 | 0:2.4.0-1.el7 |
tuned-profiles-atomic-openshift-nodeRed Hat:openshift:3.1::el7 |
before 0:3.1.1.6-1.git.0.b57e8bd.el7aos | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
rhcRed Hat:openshift:2.0::el6 |
before 0:1.38.6.1-1.el6op | 0:1.38.6.1-1.el6op |
activemqRed Hat:openshift:2.0::el6 |
before 0:5.9.0-6.redhat.611454.el6op | 0:5.9.0-6.redhat.611454.el6op |
activemq-clientRed Hat:openshift:2.0::el6 |
before 0:5.9.0-6.redhat.611454.el6op | 0:5.9.0-6.redhat.611454.el6op |
openshift-enterprise-releaseRed Hat:openshift:2.0::el6 |
before 0:2.2.9-1.el6op | 0:2.2.9-1.el6op |
openshift-enterprise-upgradeRed Hat:openshift:2.0::el6 |
before 0:2.2.9-1.el6op | 0:2.2.9-1.el6op |
openshift-enterprise-upgrade-brokerRed Hat:openshift:2.0::el6 |
before 0:2.2.9-1.el6op | 0:2.2.9-1.el6op |
openshift-enterprise-yum-validatorRed Hat:openshift:2.0::el6 |
before 0:2.2.9-1.el6op | 0:2.2.9-1.el6op |
openshift-origin-broker-utilRed Hat:openshift:2.0::el6 |
before 0:1.37.5.3-1.el6op | 0:1.37.5.3-1.el6op |
rubygem-openshift-origin-commonRed Hat:openshift:2.0::el6 |
before 0:1.29.5.2-1.el6op | 0:1.29.5.2-1.el6op |
rubygem-openshift-origin-consoleRed Hat:openshift:2.0::el6 |
before 0:1.35.5.1-1.el6op | 0:1.35.5.1-1.el6op |
rubygem-openshift-origin-controllerRed Hat:openshift:2.0::el6 |
before 0:1.38.5.1-1.el6op | 0:1.38.5.1-1.el6op |
jenkinsRed Hat:openshift:2.0::el6 |
before 0:1.625.3-1.el6op | 0:1.625.3-1.el6op |
openshift-enterprise-upgrade-nodeRed Hat:openshift:2.0::el6 |
before 0:2.2.9-1.el6op | 0:2.2.9-1.el6op |
openshift-origin-cartridge-cronRed Hat:openshift:2.0::el6 |
before 0:1.25.2.1-1.el6op | 0:1.25.2.1-1.el6op |
openshift-origin-cartridge-haproxyRed Hat:openshift:2.0::el6 |
before 0:1.31.5.1-1.el6op | 0:1.31.5.1-1.el6op |
openshift-origin-cartridge-mysqlRed Hat:openshift:2.0::el6 |
before 0:1.31.2.1-1.el6op | 0:1.31.2.1-1.el6op |
openshift-origin-cartridge-phpRed Hat:openshift:2.0::el6 |
before 0:1.35.3.1-1.el6op | 0:1.35.3.1-1.el6op |
openshift-origin-cartridge-pythonRed Hat:openshift:2.0::el6 |
before 0:1.34.2.1-1.el6op | 0:1.34.2.1-1.el6op |
openshift-origin-msg-node-mcollectiveRed Hat:openshift:2.0::el6 |
before 0:1.30.2.1-1.el6op | 0:1.30.2.1-1.el6op |
openshift-origin-node-proxyRed Hat:openshift:2.0::el6 |
before 0:1.26.2.1-1.el6op | 0:1.26.2.1-1.el6op |
openshift-origin-node-utilRed Hat:openshift:2.0::el6 |
before 0:1.38.6.2-1.el6op | 0:1.38.6.2-1.el6op |
phpRed Hat:openshift:2.0::el6 |
before 0:5.3.3-46.el6_7.1 | 0:5.3.3-46.el6_7.1 |
php-bcmathRed Hat:openshift:2.0::el6 |
before 0:5.3.3-46.el6_7.1 | 0:5.3.3-46.el6_7.1 |
php-debuginfoRed Hat:openshift:2.0::el6 |
before 0:5.3.3-46.el6_7.1 | 0:5.3.3-46.el6_7.1 |
php-develRed Hat:openshift:2.0::el6 |
before 0:5.3.3-46.el6_7.1 | 0:5.3.3-46.el6_7.1 |
php-fpmRed Hat:openshift:2.0::el6 |
before 0:5.3.3-46.el6_7.1 | 0:5.3.3-46.el6_7.1 |
php-imapRed Hat:openshift:2.0::el6 |
before 0:5.3.3-46.el6_7.1 | 0:5.3.3-46.el6_7.1 |
php-intlRed Hat:openshift:2.0::el6 |
before 0:5.3.3-46.el6_7.1 | 0:5.3.3-46.el6_7.1 |
php-mbstringRed Hat:openshift:2.0::el6 |
before 0:5.3.3-46.el6_7.1 | 0:5.3.3-46.el6_7.1 |
php-processRed Hat:openshift:2.0::el6 |
before 0:5.3.3-46.el6_7.1 | 0:5.3.3-46.el6_7.1 |
rubygem-openshift-origin-frontend-apache-vhostRed Hat:openshift:2.0::el6 |
before 0:0.13.2.1-1.el6op | 0:0.13.2.1-1.el6op |
rubygem-openshift-origin-nodeRed Hat:openshift:2.0::el6 |
before 0:1.38.5.3-1.el6op | 0:1.38.5.3-1.el6op |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Jenkins CLI - RMI Java Deserialization (Metasploit) | 2015-12-15 |
| Metasploit | Jenkins-CI Unauthenticated Script-Console Scanner | |
| Metasploit | Jenkins CLI RMI Java Deserialization Vulnerability | 2015-11-18 |
| Metasploit | OpenNMS Java Object Unserialization Remote Code Execution | 2015-11-06 |
| PoC in GitHub | cved-sources/cve-2015-8103 | 2019-01-06 |
| PoC in GitHub | r00t4dm/Jenkins-CVE-2015-8103 | 2022-10-12 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
References
packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.html
jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli
openwall.com/lists/oss-security/2015/11/18/13
rhn.redhat.com/errata/RHSA-2016-0489.html
securityfocus.com/bid/77636
Show 194 moreShow less
access.redhat.com/errata/RHSA-2016:0070
exploit-db.com/exploits/38983
foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
nvd.nist.gov/vuln/detail/CVE-2015-8103
web.archive.org/web/20151225025917/http://www.securityfocus.com/bid/77636
github.com/jenkinsci/jenkins/commit/5bd9b55a2a3249939fd78c501b8959a804c1164b
advisories.mageia.org/MGASA-2016-0137.html
bugs.mageia.org/show_bug.cgi?id=18123
lists.fedoraproject.org/pipermail/package-announce/2016-April/181046.html
bugzilla.redhat.com/show_bug.cgi?id=974814
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0070.json
cve.org/CVERecord?id=CVE-2013-2186
cisa.gov/known-exploited-vulnerabilities-catalog
activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt
This page doesn't list everything
Left out here: 230 versions and 25 references. The JSON record has them.