CVE-2016-6330 The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HT...
CriticalCVSS 9.8
EPSS 10.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat jboss operations network | = 3.0 | No fix listed |
| redhat jboss operations network | = 3.0.1 | No fix listed |
| redhat jboss operations network | = 3.1 | No fix listed |
| redhat jboss operations network | = 3.1.1 | No fix listed |
| redhat jboss operations network | = 3.1.2 | No fix listed |
| redhat jboss operations network | = 3.1.4 | No fix listed |
| redhat jboss operations network | = 3.2.0 | No fix listed |
| redhat jboss operations network | = 3.2.1 | No fix listed |
| redhat jboss operations network | = 3.2.2 | No fix listed |
| redhat jboss operations network | = 3.2.3 | No fix listed |
| redhat jboss operations network | = 3.3.1 | No fix listed |
| redhat jboss operations network | = 3.3.2 | No fix listed |
| redhat jboss operations network | = 3.3.3 | No fix listed |
| redhat jboss operations network | = 3.3.4 | No fix listed |
| redhat jboss operations network | = 3.3.5 | No fix listed |
| redhat jboss operations network | = 3.3.6 | No fix listed |
References
- 92568 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking mitigation vendor-advisory
- www.tenable.com