Lucene search

RedhatCVE-2016-0779

HistoryApr 11, 2017 - 4:59 p.m.

CVE-2016-0779

2017-04-1116:59:00

CWE-502

redhat

web.nvd.nist.gov

cve-2016-0779

apache tomee

ejbobjectinputstream

remote attackers

arbitrary code execution

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.047

Percentile

92.7%

JSON

The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.

Affected configurations

Nvd

Node

apachetomeeRange≤1.7.3

apachetomeeMatch7.0.0m1

VendorProductVersionCPE
apachetomee*cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*
apachetomee7.0.0cpe:2.3:a:apache:tomee:7.0.0:m1:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	tomee	*	cpe:2.3:a:apache:tomee::::::::
apache	tomee	7.0.0	cpe:2.3:a:apache:tomee:7.0.0:m1::::::

References

packetstormsecurity.com/files/136256/Apache-TomEE-Patched.html

tomee-openejb.979440.n4.nabble.com/Document-resolved-vulnerability-CVE-2015-8581-td4678073.html

tomee.apache.org/security/tomee.html

www.securityfocus.com/archive/1/537806/100/0/threaded

www.securityfocus.com/bid/79204

www.zerodayinitiative.com/advisories/ZDI-15-638

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.047

Percentile

92.7%

JSON

Related for CVE-2016-0779