What’s Vulnerable › Vulnerabilities

CVE-2016-4978

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-09-27 · updated 2026-06-17
• Weakness: CWE-502

Description

The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.

Affected products

• Apache Software Foundation Apache ActiveMQ Artemis: before 1.4.0 — fixed in 1.4.0
• Red Hat JBoss EAP: 6.0.0, 6.4.0, 7.0.0, 7.1.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache ActiveMQ Artemis 1.4.0. Check the vendor advisory for mitigations.

References

• http://mail-archives.apache.org/mod_mbox/activemq-users/201609.mbox/%3CCAH6wpnqzeNtpykT7emtDU1-GV7AvjFP5-YroWcCC4UZyQEFvtA%40mail.gmail.com%3E
• http://www.securityfocus.com/bid/93142
• https://access.redhat.com/errata/RHSA-2017:1834
• https://access.redhat.com/errata/RHSA-2017:1835
• https://access.redhat.com/errata/RHSA-2017:1836
• https://access.redhat.com/errata/RHSA-2017:1837
• https://access.redhat.com/errata/RHSA-2017:3454
• https://access.redhat.com/errata/RHSA-2017:3455
• https://access.redhat.com/errata/RHSA-2017:3456
• https://access.redhat.com/errata/RHSA-2017:3458
• https://access.redhat.com/errata/RHSA-2018:1447
• https://access.redhat.com/errata/RHSA-2018:1448

Get alerted when CVE-2016-4978 or the next vulnerability affects your stack