What’s Vulnerable › Vulnerabilities

CVE-2017-12149: Red Hat JBoss Application Server Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-12-10
• EPSS: 90.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-10-04 · updated 2026-10-07
• Weakness: CWE-502

Description

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Affected products

• Red Hat JBoss EAP: 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.1.2, 5.2.0 (+2)

References

• http://www.securityfocus.com/bid/100591
• https://access.redhat.com/errata/RHSA-2018:1607
• https://access.redhat.com/errata/RHSA-2018:1608
• https://bugzilla.redhat.com/show_bug.cgi?id=1486220
• https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149
• http://www.securityfocus.com/bid/100591
• https://access.redhat.com/errata/RHSA-2018:1607
• https://access.redhat.com/errata/RHSA-2018:1608
• https://bugzilla.redhat.com/show_bug.cgi?id=1486220
• https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149

Get alerted when CVE-2017-12149 or the next vulnerability affects your stack