VDB
CVE-2017-12149
CVE-2017-12149
PUBLISHED
KEV
CVSS 7.5 HIGH
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
EPSS 90.71% · 99.8th percentile
Risk Scores
CVSS 2.0
7.5
EPSS Score
90.71%
99.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| redhat | jboss_enterprise_application_platform | 5.2.2, 5.0.0, 5.0.1 |
| Red Hat, Inc. | jbossas | n/a |
Timeline
- CVE Published
- Nov 21, 2017 VulnCheck XDB Entry
- Nov 27, 2017 PoC Published
- Nov 28, 2017 VulnCheck XDB Entry
- Dec 2, 2017 VulnCheck KEV Exploitation
- Dec 22, 2017 VulnCheck XDB Entry
- May 29, 2018 PoC Published
- Dec 11, 2018 PoC Published
- Jan 8, 2019 VulnCheck KEV Exploitation
- Jun 15, 2019 VulnCheck KEV Exploitation
- Jul 8, 2019 VulnCheck KEV Exploitation
- Aug 22, 2019 VulnCheck XDB Entry
References
- Nuclei Template exploit
- RHSA-2018:1608 vendor-advisory
- 100591 vdb
- RHSA-2018:1607 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1486220 issue
- https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149 advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149 technical
- https://nvd.nist.gov/vuln/detail/CVE-2017-12149 advisory