6.5

CVE-2026-42521

Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jenkins ≫ Matrix Authorization Strategy SwPlatformjenkins Version >= 2.1 < 3.2.10
Jenkins ≫ Matrix Authorization Strategy Version2.0 Updatebeta1 SwPlatformjenkins
Jenkins ≫ Matrix Authorization Strategy Version2.0 Updatebeta2 SwPlatformjenkins
Jenkins ≫ Matrix Authorization Strategy Version2.0 Updatebeta3 SwPlatformjenkins
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.218
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.