CVE-2017-7504

CRITICAL

Red Hat JBoss Application Server Deserialization of Untrusted Data

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-7504 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC.

Description

HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 23, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1

Affected products and versions

2
ProductSourceVersion range

JBoss Application Server

Browse Red Hat / JBoss Application Server
VulnCheckVersion data not supplied

JBoss

Browse Red Hat, Inc. / JBoss
CVE List4.xaffected

Proofs of concept

1

Repository PoCs

GitHubwudidwo/CVE-2017-7504-pocRepository PoCby wudidwo0Not analyzed2 files

1.0 KiB

GitHub
PoC details

References

3