CVE-2017-12149
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
- Redhat Jboss Enterprise Application Platform
- All versions
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 90.7% (100th percentile)
- Weakness
- CWE-502
- NVD status
- Analyzed
- Published
- 2017-10-04
CVE-2017-12149 at NVD
26 known exploits for CVE-2017-12149
Proof-of-concept code and exploit modules indexed by Sploitus
CVE-2017-12149
CVE-2017-12149
CVE-2017-12149
jboss-_CVE-2017-12149
cve-2017-12149-playground
jboss-_CVE-2017-12149
CVE-2017-12149
CVE-2017-17215
CVE-2017-12149
cve-2017-12149
CVE-2017-10271
jboss-deserialization
Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform
JBoss Scanner
Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform
Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform
Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform
Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform
Exploit for Deserialization of Untrusted Data in Redhat Data_Grid
Exploit for Argument Injection in Phpmailer_Project Phpmailer
Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server
Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform
JBOSSAS 5.x/6.x Deserializer Vulnerability
JBOSSAS 5.x/6.x 反序列化命令执行漏洞（CVE-2017-12149）
Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform
JBoss Vulnerability Scanner