← Back to browse · API

CVE-2017-12149

Severity
CRITICAL
CVSS
9.8
EPSS
0.90713
Risk score
56.75
CISA KEV
Yes
PoC
No
Published
2017-10-04
Modified
2025-10-21
First seen
2026-08-07
Aliases
EUVD-2017-3733, GHSA-J5R3-WQ62-8GP5
Products
Red Hat, Inc.:jbossas n/a, Red Hat:JBoss Application Server
Sources
cisa.gov CVE-2017-12149
euvd EUVD-2017-3733

Description

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

References