CVE-2016-3690 The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.
CriticalCVSS 9.8
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat jboss enterprise application platform | = 4.2.0 | No fix listed |
| redhat jboss enterprise application platform | = 4.3.0 | No fix listed |
| redhat jboss enterprise application platform | = 5.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 5.1.0 | No fix listed |
| redhat jboss enterprise application platform | = 5.1.1 | No fix listed |
| redhat jboss enterprise application platform | = 5.1.2 | No fix listed |
| redhat jboss enterprise application platform | = 5.2.0 | No fix listed |
References
- 99079 third-party-advisory vdb-entry
- access.redhat.com mitigation vendor-advisory
- access.redhat.com mitigation vendor-advisory
- bugzilla.redhat.com issue-tracking vendor-advisory