CVE-2017-12149

Red Hat, Inc. jbossas

Published 4 Oct 2017 · updated 7 Oct 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 10 Dec 2021, with a remediation deadline of 10 Jun 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

References

www.securityfocus.com/bid/100591 · Third Party Advisory, VDB Entry
access.redhat.com/errata/RHSA-2018:1607 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:1608 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1486220 · Issue Tracking
github.com/gottburgm/Exploits/tree/master/CVE-2017-12149 · Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149 · US Government Resource