Zero-friction vulnerability management platform

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

Jenkins < 2.319.3, < 2.334 DoS Vulnerability - Windows

Information

Severity

Severity

Medium

Family

Family

Denial of Service

CVSSv2 Base

CVSSv2 Base

5.0

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Solution Type

Solution Type

Vendor Patch

Created

Created

6 months ago

Modified

Modified

6 months ago

Summary

Jenkins is prone to a denial of service (DoS) vulnerability.

Insight

Insight

Jenkins is affected by the XStream library's vulnerability CVE-2021-43859. This library is used by Jenkins to serialize and deserialize various XML files, like global and job config.xml, build.xml, and numerous others. This allows attackers able to submit crafted XML files to Jenkins to be parsed as configuration, e.g. through the POST config.xml API, to cause a denial of service (DoS).

Affected Software

Affected Software

Jenkins version 2.333 and prior and 2.319.2 LTS and prior.

Detection Method

Detection Method

Checks if a vulnerable version is present on the target host.

Solution

Solution

Update to version 2.334, 2.319.3 LTS or later.

Common Vulnerabilities and Exposures (CVE)