ZeroDay Findings
Sign inSign up

Findings

CVE-2017-12149

Red Hat JBoss Application Server Remote Code Execution Vulnerability

Published Oct 4, 2017 · updated Oct 7, 2026 · redhat jboss enterprise application platform

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 4, 2017 · Catalog

    Detected

    In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

  2. Dec 10, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 10, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Oct 7, 2026 · Catalog

    Updated

    In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Required action

Apply updates per vendor instructions.

CISA due date Jun 10, 2022

Affected

  • cpe redhat/jboss enterprise application platformversion unspecified
  • cpe redhat/jboss enterprise application platform5.0.0
  • cpe redhat/jboss enterprise application platform5.0.1
  • cpe redhat/jboss enterprise application platform5.1.0
  • cpe redhat/jboss enterprise application platform5.1.1
  • cpe redhat/jboss enterprise application platform5.1.2
  • cpe redhat/jboss enterprise application platform5.2.0
  • cpe redhat/jboss enterprise application platform5.2.1
  • vendor Red Hat JBoss Application Serverversion unspecified

Sources

  • CISA KEVCVE-2017-12149

    The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.

    cisa.gov
  • CVE.orgCVE-2017-12149

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-12149

    30-day exploitation probability 90.7%

    first.org
  • Metasploit Modulesauxiliary_scanner/http/jboss_vulnscan

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2017-12149

    In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute

    nvd.nist.gov

References