Unrated
CVE-2017-12149
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
Announced Group revision 1
Original source ↗CVE-2017-12149
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2017-12149
jbossas
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Red Hat, Inc.",
"product": "jbossas",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]- Related CVEs
- CVE-2017-12149
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #12002 · Revision 1
- Added to Heist Feed
- Publisher date