CyberRota Analysis
AI-GeneratedThe Jenkins Performance Plugin versions up to 1015.v09ca_52b_3370e are vulnerable due to inadequate restrictions on class instantiation during the deserialization of cached performance reports. This flaw allows attackers with Item/Configure permissions to execute arbitrary code on the Jenkins controller, posing a significant risk to the integrity and security of the Jenkins environment. Organizations using this plugin should prioritize remediation to mitigate potential exploitation.
Original NVD Description
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.