Cloudanix VulnDB

CVE-2017-12149

Critical · 9.8 CISA KEV · ransomware

CVSS

9.8

EPSS

90.7%

Published

Oct 4, 2017

CISA due date

Jun 10, 2022

The record

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Affected packages

Ecosystem Package Introduced Fixed
Red Hat:jboss_enterprise_application_platform:5::el5 jbossas 0 0:5.2.0-24.ep5.el5
Red Hat:jboss_enterprise_application_platform:5::el5 jbossas-client 0 0:5.2.0-24.ep5.el5
Red Hat:jboss_enterprise_application_platform:5::el5 jbossas-messaging 0 0:5.2.0-24.ep5.el5
Red Hat:jboss_enterprise_application_platform:5::el5 jbossas-ws-native 0 0:5.2.0-24.ep5.el5
Red Hat:jboss_enterprise_application_platform:5::el6 jbossas 0 0:5.2.0-24.ep5.el6
Red Hat:jboss_enterprise_application_platform:5::el6 jbossas-client 0 0:5.2.0-24.ep5.el6
Red Hat:jboss_enterprise_application_platform:5::el6 jbossas-messaging 0 0:5.2.0-24.ep5.el6
Red Hat:jboss_enterprise_application_platform:5::el6 jbossas-ws-native 0 0:5.2.0-24.ep5.el6

Related vulnerabilities