CVE-2016-7065

The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object.

Published: Oct 13, 2016
Updated: Apr 13, 2023
CVE: CVE-2016-7065
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P

CWEs:

CWE-502

OWASP TOP 10:

A8 - Insecure Deserialization

Affected Software
References

Software	From	Fixed in
redhat / jboss_enterprise_application_platform	4.0.0	4.0.0.x
redhat / jboss_enterprise_application_platform	5.0.0	5.0.0.x

http://seclists.org/fulldisclosure/2016/Nov/143
http://www.securityfocus.com/bid/93462
https://bugzilla.redhat.com/show_bug.cgi?id=1382534
https://www.exploit-db.com/exploits/40842/

Vulnerability Database

CVE-2016-7065

Deep Security Visibility Without the Complexity