CVE-2017-12149 in Red Hat Enterprise Application Platform

摘要 (英语)

In Jboss Application Server as shipped with RedHat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

预定

2017-08-01

披露

2017-10-04

条目

VulDB provides additional information and datapoints for this CVE:

标识符	漏洞	CWE	可利用	对策	CVE
107482	Red Hat Enterprise Application Platform JBoss Application Server doFilter 权限提升	502	被攻击	官方修复	CVE-2017-12149