CVE-2015-8103
CriticalSummary
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the 'Groovy variant in 'ysoserial'.
Risk Assessment
Attackers can exploit this vulnerability to execute arbitrary code remotely, potentially leading to full control over the Jenkins system and access to sensitive data.
Recommendation
It is recommended to upgrade Jenkins to version 1.638 or later and LTS to version 1.625.2 or later to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".