PT-2017-17777

CVE-2017-7504

Publicado

2017-05-19

Atualizado

2023-03-24

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jboss Application Server versions prior to 5.0

Description The issue allows remote attackers to execute arbitrary code via crafted serialized data due to a lack of restriction on the classes for which deserialization is performed in the JMS over HTTP Invocation Layer of the JbossMQ implementation.

Recommendations For Jboss Application Server versions prior to 5.0, consider disabling the JMS over HTTP Invocation Layer to prevent exploitation until a fix is available.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Adam Mariš

Joao Filho Matos Figueiredo

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-502: Deserialization of Untrusted Data

Identificadores relacionados