CVE-2017-7504: vulnerability in Red Hat, Inc. JBoss
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
52Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 39%
from disclosure to weapon
Published on NVDMay 19
VulnCheck+2134d
HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.
Affected products
Red Hat, Inc. · JBoss