GoogleOSV:GHSA-V64W-96P6-FX7W

HistoryMay 17, 2022 - 4:48 a.m.

Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1

2022-05-1704:48:11

Google

osv.dev

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.006 Low

EPSS

Percentile

78.3%

JSON

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.

CPENameOperatorVersion
org.apache.geronimo.framework:geronimo-jmx-remotingeq3.0-beta-1
org.apache.geronimo.framework:geronimo-jmx-remotingeq3.0.0
org.apache.geronimo.framework:geronimo-jmx-remotingeq3.0-M1

Name	Operator	Version
org.apache.geronimo.framework:geronimo-jmx-remoting	eq	3.0-beta-1
org.apache.geronimo.framework:geronimo-jmx-remoting	eq	3.0.0
org.apache.geronimo.framework:geronimo-jmx-remoting	eq	3.0-M1

References

archives.neohapsis.com/archives/bugtraq/2013-07/0008.html

geronimo.apache.org/30x-security-report.html

svn.apache.org/viewvc/geronimo/server/trunk

svn.apache.org/viewvc?view=revision&revision=1458113

www-01.ibm.com/support/docview.wss?uid=swg21643282

github.com/apache/geronimo

github.com/apache/geronimo/commit/ee031c5e62b0d358250d06c2aa6722518579a6c5

issues.apache.org/jira/browse/GERONIMO-6477

nvd.nist.gov/vuln/detail/CVE-2013-1777

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.006 Low

EPSS

Percentile

78.3%

JSON

Related for OSV:GHSA-V64W-96P6-FX7W