VULNERABILITY INTELLIGENCE

CVE-2016-8648

CVSS score7.2 HIGH

EPSS probability1.98%

CISA KEVNot currently listed

Published2018-08-01

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.

Weakness classification

CWE-502: Deserialization of Untrusted Data

Primary references

secalert@redhat.com — Third Party Advisory, VDB Entry
secalert@redhat.com — Issue Tracking, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mitigation, Third Party Advisory