CVE-2015-7538

Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks.

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

CVE-2015-7537 is a CSRF vulnerability in Jenkins before version 1.640 and LTS before version 1.625.2 that allows remote attackers to hijack the authentication of administrators via unspecified vectors related to the HTTP GET method.

Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave.

Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.

In Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in Remoting deserialization. This allows agents, code on agents, and attackers with Agent/Connect permission to bypass the filter for classes on the Jenkins core classpath.

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, an attacker can deserialize arbitrary types from Jenkins core or plugins via a crafted `config.xml` submission. This allows handling HTTP requests, impersonating any user, executing arbitrary code via the Script Console, or reading arbitrary files from the Jenkins controller.

The re-key admin monitor was introduced in Jenkins 1.498, re-encrypting all secrets in JENKINS_HOME with a new key and creating a backup directory with old secrets and the key used for encryption. These backups were world-readable and not removed afterwards.

Jenkins before version 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, making it easier for remote attackers to bypass the CSRF protection mechanism via a brute-force approach.