9.8crit
CVE-2017-12149KEV · ransomwarein critical feed1 exploitNuclei template
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadO…
Published 9 y ago · modified 31 d ago · JSON
CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2021-12-10
EPSS
90.7%
percentile 100%
Public exploits
1
Metasploit · Nuclei check
Summary
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
Known exploited (CISA KEV)
- Added
- 4 y ago
- Due date
- 2022-06-10 (4 y ago)
- Ransomware use
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor / product
- Red Hat / JBoss Application Server
- CISA name
- Red Hat JBoss Application Server Remote Code Execution Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction (EPSS)
90.71% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.
Exploits and detections
- Nuclei template Jboss Application Server - Remote Code Execution · nuclei detection template
- Metasploit auxiliary/scanner/http/jboss_vulnscan JBoss Vulnerability Scanner · metasploit auxiliary, normal rank
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Red Hat, Inc. jbossas
Classification
- Weakness
- CWE-502 Deserialization of Untrusted Data
References
- bugzilla.redhat.com /show_bug.cgi?id=1486220 · x_refsource_CONFIRM, x_transferred
- access.redhat.com /errata/RHSA-2018:1608 · vendor-advisory, x_refsource_REDHAT, x_transferred
- github.com /gottburgm/Exploits/tree/master/CVE-2017-12149 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/100591 · vdb-entry, x_refsource_BID, x_transferred
- access.redhat.com /errata/RHSA-2018:1607 · vendor-advisory, x_refsource_REDHAT, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149 · government-resource
Sources
- CVE List: CVE-2017-12149
- NVD: CVE-2017-12149
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.