CVE-2017-12149

State: Published
Severity: 9.8 Critical
Published: Oct 4, 2017
Updated: Oct 7, 2026
Reserved: Aug 1, 2017

Description

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-502

Affected Products

Product	Versions
jbossasRed Hat, Inc.	n/aAffected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1486220
RHSA-2018:1608vendor-advisory
https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149
100591vdb-entry
RHSA-2018:1607vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.