CVE-2017-12149

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-12149
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.securityfocus.com/bid/100591 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:1607 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1608 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1486220 Issue Tracking
https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149 Third Party Advisory
http://www.securityfocus.com/bid/100591 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:1607 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1608 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1486220 Issue Tracking
https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.2:*:*:*:*:*:*:*
History

07 Oct 2026, 17:58

Type Values Removed Values Added
References () http://www.securityfocus.com/bid/100591 - Broken Link, Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/100591 - Third Party Advisory, VDB Entry
Information

Published : 2017-10-04 21:01

Updated : 2026-10-07 17:58

NVD link : CVE-2017-12149

Mitre link : CVE-2017-12149

CVE.ORG link : CVE-2017-12149

JSON object : View

Products Affected

redhat

  • jboss_enterprise_application_platform
CWE
CWE-502

Deserialization of Untrusted Data