CVE-2017-12149

highpriority · act · 90OT risk · criticalKEV · exploitedEU KEV · CERT ItaliaEPSS 0.907 · 100 %ileexploit · functionalEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 12 exploits · functional

Likely / severe?

90.7% (100th) EPSS

CVSS 7.5 · high

Is it mine?

24 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2021-12-10remediate by 2022-06-10

required action Apply updates per vendor instructions.

EU KEVflagged by CERT Italiareported 2025-07-14patched 2018-05-17

Servlet exposes an endpoint that allows you to invoke Java Management Extensions (JMX) operations without any authentication or access control

EPSS · scored 2026-10-27

Red Hat JBoss Application Server Remote Code Execution Vulnerability

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedjbossas-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Fixedjbossas-0:5.2.0-24.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Fixedjbossas-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Fixedjbossas-0:5.2.0-24.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Fixedjbossas-client-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Fixedjbossas-client-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Fixedjbossas-messaging-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Fixedjbossas-messaging-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Fixedjbossas-ws-native-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
Fixedjbossas-ws-native-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:1607
FixedRed Hat JBoss Enterprise Application Platform 5redhat_csaf
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2018:1608
Workaroundjbossas-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-0:5.2.0-24.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-0:5.2.0-24.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-client-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-client-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-messaging-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-messaging-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-ws-native-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
Workaroundjbossas-ws-native-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.
WorkaroundRed Hat JBoss Enterprise Application Platform 5redhat_csaf
Secure the access to the entire http-invoker contexts by adding <url-pattern>/*</url-pattern> to the security-constraints in the web.xml file of the http-invoker.sar.The users who do not wish to use the http-invoker.sar can remove it.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USprimaryCWE-502USCWE-502US

exploits (12)

Public proof-of-concept and weaponised exploit code.

auxiliary/scanner/http/jboss_vulnscanJBoss Vulnerability Scannerfunctional · metasploit
1337g/CVE-2017-12149CVE-2017-12149 JBOSS RCE (TESTED) PoC · poc_in_github
CyberCTF/vulhub-jboss-cve-2017-12149Vulhub jboss/CVE-2017-12149: JBoss AS 6.1.0 HTTP invoker deserialization, run with IsoloomPoC · poc_in_github
JesseClarkND/CVE-2017-12149Update of https://github.com/1337g/CVE-2017-12149 to work with python3PoC · poc_in_github
MrE-Fog/jboss-_CVE-2017-12149MrE-Fog/jboss-_CVE-2017-12149PoC · poc_in_github
VVeakee/CVE-2017-12149VVeakee/CVE-2017-12149PoC · poc_in_github

affected products (24)

Products and version ranges known to be affected.

Red Hat, Inc. jbossas≤ n/aenisa_euvdEU
Red Hat Inc. JBoss EAP≤ 5fstec_bduRU
Red Hat Inc. JBoss Enterprise Application Platform≤ 5 for RHEL 5fstec_bduRU
Red Hat Inc. JBoss Enterprise Application Platform≤ 5 for RHEL 6fstec_bduRU
redhat jboss enterprise application platformall versionsnvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.0.0nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.0.1nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.1.0nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.1.1nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.1.2nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.2.0nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.2.1nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 5.2.2nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
Red Hat JBoss Enterprise Application Platform 5all versionsfixedredhat_csafUScpe:/a:redhat:jboss_enterprise_application_platform:5
jbossas-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverall versionsfixedredhat_csafUS
jbossas-0:5.2.0-24.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverall versionsfixedredhat_csafUS
jbossas-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverall versionsfixedredhat_csafUS
jbossas-0:5.2.0-24.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverall versionsfixedredhat_csafUS
jbossas-client-0:5.2.0-24.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverall versionsfixedredhat_csafUS
jbossas-client-0:5.2.0-24.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverall versionsfixedredhat_csafUS

showing 20 of 24

advisories (2)

Vendor and ecosystem advisories describing this.

RHSA-2018:1607Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update2018-05-17csaf · redhat_csafUS
An update is now available for Red Hat JBoss Enterprise Application Platform 5 for Red Hat Enterprise Linux 5 and Red Hat JBoss Enterprise Application Platform 5 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2018:1608Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update2018-05-17csaf · redhat_csafUS
An update is now available for Red Hat JBoss Enterprise Application Platform. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd redhat_csaf NVD CVE.org MITRE

published 2017-10-04modified 2026-10-07

related (3,744)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-63077US	—OT critical	93.6% (100th)	KEV	2026-07-27
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-58644US	—OT critical	15.9% (97th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-50522US	—OT critical	3.04% (87th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-12569US	critical9.8OT critical	46.0% (99th)	KEV	2026-06-18
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of u…
CVE-2026-45247US	—OT critical	26.2% (98th)	KEV	2026-05-26
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code exec…

+3739 more

references (13)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan