CVEvulnerability

CVE-2017-12149

9.8 CRITICAL Known exploited Published 2017-10-04 Modified 2026-10-07 Official page ↗

CISA Known Exploited Vulnerability

Red Hat JBoss Application Server Remote Code Execution Vulnerability — Red Hat JBoss Application Server

The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.

Added to KEV: 2021-12-10
Remediation due: 2022-06-10
Ransomware use: Known
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-12149

Status: Analyzed
Published: 2017-10-04
Last modified: 2026-10-07
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses: CWE-502

Description

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Affected configurations

• redhat jboss enterprise application platform • redhat jboss enterprise application platform 5.0.0 • redhat jboss enterprise application platform 5.0.1 • redhat jboss enterprise application platform 5.1.0 • redhat jboss enterprise application platform 5.1.1 • redhat jboss enterprise application platform 5.1.2 • redhat jboss enterprise application platform 5.2.0 • redhat jboss enterprise application platform 5.2.1 • redhat jboss enterprise application platform 5.2.2

Weakness · CWE (1)

CWE-502 Deserialization of Untrusted Data weakness

References