JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization

The JMS over HTTP Invocation Layer in JBossMQ, as implemented in HTTPServerILServlet.java in JBoss Application Server AS 4.x and earlier, does not properly restrict the classes that can be deserialized from the raw POST body. This allows remote attackers to execute arbitrary code or cause a denia...

cve-2017-12149-playground

Muchas industrias críticas banca, atención médica y manufactura dependen de middleware heredado que fue construido para ejecutarse específicamente en JBoss 5 o 6. Debido a que estas aplicaciones suelen ser demasiado frágiles para migrar a versiones modernas de WildFly el sucesor de JBoss, las...

CVE-2017-7504

HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server = Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via...