CVE-2016-6330
CRITICALRed Hat JBoss Operations Network (JON) - RCE
Title source: llmDescription
The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.
Scores
CVSS v3
9.8
EPSS
0.1300
EPSS Percentile
94.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-502
Status
draft
Affected Products (16)
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
redhat/jboss_operations_network
... and 1 more
Timeline
Published
Sep 27, 2016
Tracked Since
Feb 18, 2026