Remote code execution

2017-11-2710:29:00

PRIOn knowledge base

www.prio-n.com

9.6 High

AI Score

Confidence

High

0.064 Low

EPSS

Percentile

93.7%

JSON

In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.

CPENameOperatorVersion
spring_advanced_message_queuing_protocoleq1.7.3
spring_advanced_message_queuing_protocoleq1.7.2
spring_advanced_message_queuing_protocoleq1.7.1
spring_advanced_message_queuing_protocoleq1.7.0
spring_advanced_message_queuing_protocoleq1.6.0 m2
spring_advanced_message_queuing_protocoleq1.6.0 m1
spring_advanced_message_queuing_protocoleq1.6.0 rc1
spring_advanced_message_queuing_protocoleq1.6.0
spring_advanced_message_queuing_protocoleq1.6.1
spring_advanced_message_queuing_protocoleq1.6.2

Name	Operator	Version
spring_advanced_message_queuing_protocol	eq	1.7.3
spring_advanced_message_queuing_protocol	eq	1.7.2
spring_advanced_message_queuing_protocol	eq	1.7.1
spring_advanced_message_queuing_protocol	eq	1.7.0
spring_advanced_message_queuing_protocol	eq	1.6.0 m2
spring_advanced_message_queuing_protocol	eq	1.6.0 m1
spring_advanced_message_queuing_protocol	eq	1.6.0 rc1
spring_advanced_message_queuing_protocol	eq	1.6.0
spring_advanced_message_queuing_protocol	eq	1.6.1
spring_advanced_message_queuing_protocol	eq	1.6.2