Every CVE Search/ Get API key

CVE-2016-0792

Jenkins allows Deserialization of Untrusted Data via an XML File

8.8 HighPublic exploitFix available

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

83.3%Down 9.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Record
CVE-2016-0792
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Record
CVE-2016-0792
Updated
2026-11-02
EUVDEUVD-2016-0803 No score

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Record
EUVD-2016-0803
Updated
2026-11-03
GitHub AdvisoriesGHSA-45rg-g72w-r393 8.8

Jenkins allows Deserialization of Untrusted Data via an XML File

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Record
GHSA-45rg-g72w-r393
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-502
Updated
2026-11-02
OSV 8.8

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Record
CVE-2016-0792
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-45rg-g72w-r393 8.8

Jenkins allows Deserialization of Untrusted Data via an XML File

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Record
GHSA-45rg-g72w-r393
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-502
Updated
2026-11-02
OSVRHSA-2016:1773 4.8

Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.10 security, bug fix, and enhancement update

Record
RHSA-2016:1773
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2016-0162 No score

Updated jenkins-remoting packages fix CVE-2016-0792

Updated jenkins-remoting packages fix security vulnerability:

Jenkins has several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution. (SECURITY-247 / CVE-2016-0792)

Record
MGASA-2016-0162
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.main:jenkins-core
Maven
 1.643 up to 1.650
1.650
org.jenkins-ci.main:jenkins-core
Maven
 before 1.642
1.642
org.jenkins-ci.main:jenkins-core
Maven
 1.643 up to 1.650, plus listed versions
1.6441.6451.6461.6471.6481.649
1.650
org.jenkins-ci.main:jenkins-core
Maven
 before 1.642.2, plus listed versions
1.3961.3971.3981.3991.400
Show 45 moreShow less
1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437
1.642.2
jenkins-remoting
Mageia:5
 before 2.53.3-1.mga5
2.53.3-1.mga5
jenkins
Red Hat:openshift:3.1::el7
 before 0:1.642.2-1.el7
0:1.642.2-1.el7
jenkins-plugin-credentials
Red Hat:openshift:3.1::el7
 before 0:1.24-2.el7
0:1.24-2.el7
jenkins-plugin-durable-task
Red Hat:openshift:3.1::el7
 before 0:1.7-1.el7
0:1.7-1.el7
jenkins-plugin-kubernetes
Red Hat:openshift:3.1::el7
 before 0:0.5-1.el7
0:0.5-1.el7
jenkins-plugin-openshift-pipeline
Red Hat:openshift:3.1::el7
 before 0:1.0.9-1.el7
0:1.0.9-1.el7
Show 37 moreShow less
Affected packages
PackageAffectedFixed
rhc
Red Hat:openshift:2.0::el6
 before 0:1.38.7.1-1.el6op
0:1.38.7.1-1.el6op
activemq
Red Hat:openshift:2.0::el6
 before 0:5.9.0-6.redhat.611463.el6op
0:5.9.0-6.redhat.611463.el6op
activemq-client
Red Hat:openshift:2.0::el6
 before 0:5.9.0-6.redhat.611463.el6op
0:5.9.0-6.redhat.611463.el6op
openshift-origin-broker
Red Hat:openshift:2.0::el6
 before 0:1.16.3.2-1.el6op
0:1.16.3.2-1.el6op
openshift-origin-broker-util
Red Hat:openshift:2.0::el6
 before 0:1.37.6.2-1.el6op
0:1.37.6.2-1.el6op
rubygem-openshift-origin-admin-console
Red Hat:openshift:2.0::el6
 before 0:1.28.2.1-1.el6op
0:1.28.2.1-1.el6op
rubygem-openshift-origin-controller
Red Hat:openshift:2.0::el6
 before 0:1.38.6.4-1.el6op
0:1.38.6.4-1.el6op
rubygem-openshift-origin-msg-broker-mcollective
Red Hat:openshift:2.0::el6
 before 0:1.36.2.4-1.el6op
0:1.36.2.4-1.el6op
rubygem-openshift-origin-routing-daemon
Red Hat:openshift:2.0::el6
 before 0:0.26.6.1-1.el6op
0:0.26.6.1-1.el6op
openshift-origin-cartridge-jbosseap
Red Hat:openshift:2.0::el6
 before 0:2.27.4.2-1.el6op
0:2.27.4.2-1.el6op
ImageMagick
Red Hat:openshift:2.0::el6
 before 0:6.7.2.7-5.el6_8
0:6.7.2.7-5.el6_8
ImageMagick-debuginfo
Red Hat:openshift:2.0::el6
 before 0:6.7.2.7-5.el6_8
0:6.7.2.7-5.el6_8
ImageMagick-devel
Red Hat:openshift:2.0::el6
 before 0:6.7.2.7-5.el6_8
0:6.7.2.7-5.el6_8
ImageMagick-doc
Red Hat:openshift:2.0::el6
 before 0:6.7.2.7-5.el6_8
0:6.7.2.7-5.el6_8
ImageMagick-perl
Red Hat:openshift:2.0::el6
 before 0:6.7.2.7-5.el6_8
0:6.7.2.7-5.el6_8
jenkins
Red Hat:openshift:2.0::el6
 before 0:1.651.2-1.el6op
0:1.651.2-1.el6op
libcgroup
Red Hat:openshift:2.0::el6
 before 0:0.40.rc1-18.el6_8
0:0.40.rc1-18.el6_8
libcgroup-debuginfo
Red Hat:openshift:2.0::el6
 before 0:0.40.rc1-18.el6_8
0:0.40.rc1-18.el6_8
libcgroup-pam
Red Hat:openshift:2.0::el6
 before 0:0.40.rc1-18.el6_8
0:0.40.rc1-18.el6_8
openshift-origin-cartridge-cron
Red Hat:openshift:2.0::el6
 before 0:1.25.4.2-1.el6op
0:1.25.4.2-1.el6op
openshift-origin-cartridge-diy
Red Hat:openshift:2.0::el6
 before 0:1.26.2.2-1.el6op
0:1.26.2.2-1.el6op
openshift-origin-cartridge-haproxy
Red Hat:openshift:2.0::el6
 before 0:1.31.6.2-1.el6op
0:1.31.6.2-1.el6op
openshift-origin-cartridge-jbossews
Red Hat:openshift:2.0::el6
 before 0:1.35.5.2-1.el6op
0:1.35.5.2-1.el6op
openshift-origin-cartridge-jenkins
Red Hat:openshift:2.0::el6
 before 0:1.29.2.2-1.el6op
0:1.29.2.2-1.el6op
openshift-origin-cartridge-jenkins-client
Red Hat:openshift:2.0::el6
 before 0:1.26.1.1-1.el6op
0:1.26.1.1-1.el6op
openshift-origin-cartridge-mongodb
Red Hat:openshift:2.0::el6
 before 0:1.26.2.2-1.el6op
0:1.26.2.2-1.el6op
openshift-origin-cartridge-mysql
Red Hat:openshift:2.0::el6
 before 0:1.31.3.3-1.el6op
0:1.31.3.3-1.el6op
openshift-origin-cartridge-nodejs
Red Hat:openshift:2.0::el6
 before 0:1.33.1.2-1.el6op
0:1.33.1.2-1.el6op
openshift-origin-cartridge-perl
Red Hat:openshift:2.0::el6
 before 0:1.30.2.2-1.el6op
0:1.30.2.2-1.el6op
openshift-origin-cartridge-php
Red Hat:openshift:2.0::el6
 before 0:1.35.4.2-1.el6op
0:1.35.4.2-1.el6op
openshift-origin-cartridge-python
Red Hat:openshift:2.0::el6
 before 0:1.34.3.2-1.el6op
0:1.34.3.2-1.el6op
openshift-origin-cartridge-ruby
Red Hat:openshift:2.0::el6
 before 0:1.32.2.2-1.el6op
0:1.32.2.2-1.el6op
openshift-origin-msg-node-mcollective
Red Hat:openshift:2.0::el6
 before 0:1.30.2.2-1.el6op
0:1.30.2.2-1.el6op
openshift-origin-node-proxy
Red Hat:openshift:2.0::el6
 before 0:1.26.3.1-1.el6op
0:1.26.3.1-1.el6op
openshift-origin-node-util
Red Hat:openshift:2.0::el6
 before 0:1.38.7.1-1.el6op
0:1.38.7.1-1.el6op
rubygem-openshift-origin-frontend-haproxy-sni-proxy
Red Hat:openshift:2.0::el6
 before 0:0.5.2.1-1.el6op
0:0.5.2.1-1.el6op
rubygem-openshift-origin-node
Red Hat:openshift:2.0::el6
 before 0:1.38.6.4-1.el6op
0:1.38.6.4-1.el6op

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBJenkins < 1.650 - Java Deserialization2017-07-30
Exploit-DBJenkins - XStream Groovy classpath Deserialization (Metasploit)2017-12-19
MetasploitJenkins XStream Groovy classpath Deserialization Vulnerability2016-02-24
PoC in GitHubAviksaikat/CVE-2016-07922021-09-07
PoC in GitHubjpiechowka/jenkins-cve-2016-07922017-07-30

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-0792 is a high vulnerability (CVSS 8.8) in Jenkins, published April 7, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 83.3%, the 99th percentile. Fixed in org.jenkins-ci.main:jenkins-core 1.650.

References

Show 82 moreShow less
This page doesn't list everything

Left out here: 250 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open