Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Jboss EAP Deserialization of Untrusted Data Vulnerability - CVE-2016-4978 - Vulnerability Database
Jboss EAP

Jboss EAP Deserialization of Untrusted Data Vulnerability - CVE-2016-4978

High
Reference: CVE-2016-4978
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2016-4978
Title: Jboss EAP Deserialization of Untrusted Data Vulnerability
Overview:

The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client (2) Artemis broker and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.