Jboss Application Server HTTPServerILServlet.java remote code execution

Description

Red Hat Jboss Application Server could allow a remote attacker to execute arbitrary code on the system, caused by a deserialization flaw in the HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation. By using specially-crafted serialized data, an attacker could exploit this vulnerability to execute arbitrary code on the system.

Remediation

Upgrade to the latest version of JBoss.

References

Related Vulnerabilities

Severity

High

Classification

CVE-2017-7504 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution Acumonitor