CVE-2017-12149: critical vulnerability in Red Hat, Inc. jbossas
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
JBoss application servers can be tricked into running malicious code hidden in specially crafted data. An attacker can send this data and the server will automatically execute it without proper safety checks.
CVE-2017-12149 exploits unsafe deserialization in JBoss Application Server's HTTP Invoker ReadOnlyAccessFilter. The doFilter method lacks class validation during object deserialization, enabling arbitrary code execution through malicious serialized payloads. No authentication is required; the vulnerability is network-accessible.
The full analysis of this CVE is available in Portuguese →