CVE-2016-3737

It was discovered that sending specially crafted HTTP request to the JON server would allow deserialization of that message without authentication. An attacker could use this flaw to cause remote code execution.

Mitigation

Apply the configuration changes described in the documentation here: <https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Operations_Network/3.3/html/Admin_and_Config/JBoss_ON_and_SSL-Authentication.html&gt;
For more information, refer to <https://access.redhat.com/articles/2570101&gt;.