CVE-2017-12149

highPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEU KEV · CERT ItaliaEPSS 0.907 · 100. PerzentilExploit · funktionalEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 12 exploits · funktional

Likely / severe?

90.7% (100th) EPSS

CVSS 7.5 · high

Is it mine?

24 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

hinzugefügt 2021-12-10beheben bis 2022-06-10

erforderliche Maßnahme Apply updates per vendor instructions.

EU KEVgemeldet von CERT Italiagemeldet 2025-07-14gepatcht 2018-05-17

Servlet exposes an endpoint that allows you to invoke Java Management Extensions (JMX) operations without any authentication or access control

EPSS · bewertet 2026-10-27

Red Hat JBoss Application Server Remote Code Execution Vulnerability

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenjbossas-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Behobenjbossas-0:5.2.0-24.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Behobenjbossas-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Behobenjbossas-0:5.2.0-24.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Behobenjbossas-client-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Behobenjbossas-client-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Behobenjbossas-messaging-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Behobenjbossas-messaging-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Behobenjbossas-ws-native-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Behobenjbossas-ws-native-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
BehobenRed Hat JBoss Enterprise Application Platform 5redhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2018:1608
Workaroundjbossas-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-0:5.2.0-24.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-0:5.2.0-24.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-client-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-client-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-messaging-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-messaging-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-ws-native-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-ws-native-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
WorkaroundRed Hat JBoss Enterprise Application Platform 5redhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 3.9 · Auswirkung 5.9

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-502USprimärCWE-502USCWE-502US

Exploits (12)

Öffentlicher Proof-of-Concept- und Exploit-Code.

auxiliary/scanner/http/jboss_vulnscanJBoss Vulnerability Scannerfunktional · metasploit
1337g/CVE-2017-12149CVE-2017-12149 JBOSS RCE (TESTED) PoC · poc_in_github
CyberCTF/vulhub-jboss-cve-2017-12149Vulhub jboss/CVE-2017-12149: JBoss AS 6.1.0 HTTP invoker deserialization, run with IsoloomPoC · poc_in_github
JesseClarkND/CVE-2017-12149Update of https://github.com/1337g/CVE-2017-12149 to work with python3PoC · poc_in_github
MrE-Fog/jboss-_CVE-2017-12149MrE-Fog/jboss-_CVE-2017-12149PoC · poc_in_github
VVeakee/CVE-2017-12149VVeakee/CVE-2017-12149PoC · poc_in_github

betroffene Produkte (24)

Betroffene Produkte und Versionsbereiche.

Red Hat, Inc. jbossas≤ n/aenisa_euvdEU
Red Hat Inc. JBoss EAP≤ 5fstec_bduRU
Red Hat Inc. JBoss Enterprise Application Platform≤ 5 for RHEL 5fstec_bduRU
Red Hat Inc. JBoss Enterprise Application Platform≤ 5 for RHEL 6fstec_bduRU
redhat jboss enterprise application platformalle VersionennvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.0.0nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.0.1nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.1.0nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.1.1nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.1.2nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.2.0nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.2.1nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.2.2nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
Red Hat JBoss Enterprise Application Platform 5alle Versionenfixedredhat_csafUScpe:/a:redhat:jboss_enterprise_application_platform:5
jbossas-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serveralle Versionenfixedredhat_csafUS
jbossas-0:5.2.0-24.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serveralle Versionenfixedredhat_csafUS
jbossas-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serveralle Versionenfixedredhat_csafUS
jbossas-0:5.2.0-24.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serveralle Versionenfixedredhat_csafUS
jbossas-client-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serveralle Versionenfixedredhat_csafUS
jbossas-client-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serveralle Versionenfixedredhat_csafUS

20 von 24 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2018:1607Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update2018-05-17csaf · redhat_csafUS
An update is now available for Red Hat JBoss Enterprise Application Platform 5 for Red Hat Enterprise Linux 5 and Red Hat JBoss Enterprise Application Platform 5 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2018:1608Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update2018-05-17csaf · redhat_csafUS
An update is now available for Red Hat JBoss Enterprise Application Platform. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu nvd redhat_csaf NVD CVE.org MITRE

veröffentlicht 2017-10-04geändert 2026-10-07

verwandt (3,744)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-63077US	—OT kritisch	93.6% (100th)	KEV	2026-07-27
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-58644US	—OT kritisch	15.9% (97th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-50522US	—OT kritisch	3.04% (87th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-12569US	critical9.8OT kritisch	46.0% (99th)	KEV	2026-06-18
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of u…
CVE-2026-45247US	—OT kritisch	26.2% (98th)	KEV	2026-05-26
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code exec…

+3739 weitere

Referenzen (13)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan