CVE Vulnerability Advisory Database

[Affected Scope] Jenkins weekly version 2.153 and earlier, LTS version 2.138.3 and earlier utilizing the Stapler web framework.

[Impact] Unauthenticated remote attackers can invoke arbitrary methods on Java objects by sending crafted URLs, leading to full Remote Code Execution (RCE) under system privileges.

[Mitigation] Immediately upgrade Jenkins weekly to version 2.154 or later, and LTS to version 2.138.4 or later.

[Affected Scope] Oracle Java 7 Update 10 and earlier versions (all versions prior to Java 7 Update 11).

[Impact] Remote attackers can completely bypass the JVM security sandbox and execute arbitrary system commands with the privileges of the running user by enticing them to visit a malicious web page containing a crafted Java applet.

[Mitigation] Immediately upgrade to Oracle Java 7 Update 11 or later (or migrate to modern LTS versions like Java 8/11/17), and disable the Java browser plug-in across all enterprise endpoints.

[Affected Scope] Oracle Java SE 7 Update 6 and earlier JRE (Java Runtime Environment) versions

[Impact] Remote attackers can completely bypass SecurityManager restrictions and execute arbitrary code with elevated privileges via a crafted malicious applet

[Mitigation] Immediately upgrade to Java SE 7 Update 7 or later, or disable the Java browser plugin across all endpoints