CVE Vulnerability Advisory Database

[Affected Scope] All Java-based web applications utilizing RichFaces Framework versions 3.0.0 through 3.3.4.

[Impact] A remote, unauthenticated attacker can execute arbitrary system commands and fully compromise the host by sending a crafted chain of serialized Java objects.

[Mitigation] Migrate legacy RichFaces 3.X applications to supported frameworks, or restrict external access to the vulnerable '/org.ajax4jsf.resource.UserResource' path using WAF rules or servlet filters.

[Affected Scope] JBoss Application Server shipped with Red Hat Enterprise Application Platform (EAP) 5.2, specifically when the HTTP Invoker (ReadOnlyAccessFilter) is enabled.

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with the privileges of the JBoss process by sending crafted serialized Java objects.

[Mitigation] Apply official Red Hat security updates, disable or restrict access to the HTTP Invoker servlet, or block serialization payloads using a Web Application Firewall (WAF).

[Affected Scope] JBoss Seam 2 (jboss-seam2) framework as integrated in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux

[Impact] Remote attackers can execute arbitrary Java code and system commands via crafted URLs when the Java Security Manager is not properly configured

[Mitigation] Upgrade to the patched version of JBoss Seam/EAP, enable the Java Security Manager, and implement strict input validation filters

[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08.

[Impact] Remote attackers can bypass authentication and access sensitive administrative information within the Web Console by utilizing non-standard HTTP methods (such as HEAD or PUT).

[Mitigation] Apply the official Cumulative Patch (CP) or modify the web.xml configuration to enforce authentication across all HTTP methods.