CVE-2016-0779

Name of the Vulnerable Software and Affected Versions Apache TomEE versions prior to 1.7.4 Apache TomEE versions 7.x prior to 7.0.0-M3

Description The issue is related to insufficient access control in the EjbObjectInputStream class of the Apache TomEE application server. It can be exploited by a remote attacker using a specially crafted serialized object to execute arbitrary code.

Recommendations For Apache TomEE versions prior to 1.7.4, update to version 1.7.4 or later. For Apache TomEE versions 7.x prior to 7.0.0-M3, update to version 7.0.0-M3 or later.