CVE-2017-7504

high-risk

Published 2017-05-19

HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.

Do I need to act?

90.3% chance of exploitation in next 30 days

EPSS score — higher than 10% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (1)

Jboss Enterprise Application Platform

Affected Vendors

Redhat

References (4)

Third Party Advisory http://www.securityfocus.com/bid/98595

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1451441

Third Party Advisory http://www.securityfocus.com/bid/98595

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1451441

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 20/34 · Moderate

Exposure 5/34 · Minimal