CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2017-10-04
Red Hat JBoss Application Server HTTP Invoker Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2017-12149) Analysis and Mitigation Guide
[Affected Scope] JBoss Application Server shipped with Red Hat Enterprise Application Platform (EAP) 5.2, specifically when the HTTP Invoker (ReadOnlyAccessFilter) is enabled.
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with the privileges of the JBoss process by sending crafted serialized Java objects.
[Mitigation] Apply official Red Hat security updates, disable or restrict access to the HTTP Invoker servlet, or block serialization payloads using a Web Application Firewall (WAF).