7.2

CVE-2016-4978

The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Activemq Artemis Version < 1.4.0
Redhat ≫ Jboss Enterprise Application Platform Version6.0.0
   Redhat ≫ Enterprise Linux Server Version5.0
   Redhat ≫ Enterprise Linux Server Version6.0
   Redhat ≫ Enterprise Linux Server Version7.0
Redhat ≫ Jboss Enterprise Application Platform Version6.4.0
   Redhat ≫ Enterprise Linux Server Version5.0
   Redhat ≫ Enterprise Linux Server Version6.0
   Redhat ≫ Enterprise Linux Server Version7.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.08% 0.771
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6 6.8 6.4
AV:N/AC:M/Au:S/C:P/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

http://www.securityfocus.com/bid/93142
Third Party Advisory
VDB Entry