Critical severity · published Oct 4, 2017
CVE-2017-12149
Red Hat JBoss Application Server Remote Code Execution Vulnerability
RansomwareIn wildKEV
9.8
CVSS
90.7%
EPSS
Yes
On KEV
Description
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)90.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 10, 2021
Federal remediation dueJun 10, 2022
Ransomware campaign useKnown
Affected products
Which versions
JB
jbossas · Red Hat, Inc.
All versions, or not specified · source: vendor
JE
Jboss Enterprise Application Platform · Redhat
5.0.0; 5.0.1; 5.1.0; 5.1.1; 5.1.2; 5.2.0; +2 more · source: NVD
JA
JBoss Application Server · Red Hat
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12149
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12149
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1486220
vendor-advisory
https://access.redhat.com/errata/RHSA-2018:1608
x_refsource_MISC
https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149
vdb-entry
http://www.securityfocus.com/bid/100591
vendor-advisory
https://access.redhat.com/errata/RHSA-2018:1607