CVE-2017-12149
KEV
🔴 Łataj teraz
Brak ograniczeń w deserializacji w JBoss Application Server umożliwia wykonanie dowolnego kodu.
CVSS
9.8
EPSS
94.3%
Exploit
weaponized
Vendor
redhat
Opis źródłowy (NVD)
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
deserialization
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.8 |
| CISA KEV (aktywnie wykorzystywane) | Tak |
| FIRST EPSS (prawdopodobieństwo exploita) | 94.3% |
| Opublikowano (NVD) | 2017-10-04 21:01:00 UTC |
| Ostatnia modyfikacja (NVD) | 2026-04-21 19:36:59 UTC |
Referencje
- http://www.securityfocus.com/bid/100591 (secalert@redhat.com) [Broken Link, Third Party Advisory, VDB Entry]
- https://access.redhat.com/errata/RHSA-2018:1607 (secalert@redhat.com) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2018:1608 (secalert@redhat.com) [Third Party Advisory]
- https://bugzilla.redhat.com/show_bug.cgi?id=1486220 (secalert@redhat.com) [Issue Tracking]
- https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149 (secalert@redhat.com) [Third Party Advisory]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [US Government Resource]