7.2high
CVE-2016-8648
It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.2
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 81%
Public exploits
0
none known
Summary
It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.
Exploit prediction (EPSS)
1.98% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- Apache Software Foundation Karaf
Classification
- Weakness
- CWE-502 Deserialization of Untrusted Data
References
- securityfocus.com /bid/94513 · vdb-entry, x_refsource_BID, x_transferred
- bugzilla.redhat.com /show_bug.cgi?id=CVE-2016-8648 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2016-8648
- NVD: CVE-2016-8648
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.