THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2017-12149 (CRITICAL 9.8) — In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute

[NVD] CVE-2017-12149 (CRITICAL 9.8) — In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute

lownvdPublished 2017-10-04

CVE-2017-12149 CVSS: 9.8 CRITICAL Published: 2017-10-04T21:01:00.180

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2017-12149