8.1

CVE-2016-2510

Exploit
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Beanshell ≫ Beanshell Version1.0
Beanshell ≫ Beanshell Version2.0 Updatebeta1
Beanshell ≫ Beanshell Version2.0 Updatebeta4
Beanshell ≫ Beanshell Version2.0 Updatebeta5
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version15.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 38.91% 0.971
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.securityfocus.com/bid/84139
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1035440
Third Party Advisory
VDB Entry
https://github.com/frohoff/ysoserial/pull/13
Third Party Advisory
Exploit