Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:12527
HistoryJan 15, 2019 - 9:18 a.m.

Remote Code Execution Through Deserialization Attack

2019-01-1509:18:13
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
19

EPSS

0.017

Percentile

87.6%

JSON

Apache ActiveMQ Artemis is vulnerable to deserialization attacks. The JMS specification outlines a getObject() method on the javax.jms.ObjectMessage class. The Apache Artemis implementation of this method allows the deserialization of objects, from untrusted sources. There are several places where Apache Artemis uses this getObject() method. These components may therefore be vulnerable to a remote code execution attacks. For this vulnerability to be exploited, the sender of the compromised message needs to be authenticated and authorized in order to send the message to the Artemis broker and affected classes (gadget classes) present on the Artemis class path.

References

Related

prion 2
cve 2
openvas 1
osv 1
github 1
nvd 2
cvelist 2
redhat 16
redhatcve 1
nessus 11
prion
prion
Path traversal
2016-09-27 15:59:00
Hardcoded credentials
2021-12-23 20:15:00
cve
cve
CVE-2016-4978
2016-09-27 15:59:01
CVE-2021-20318
2021-12-23 20:15:08
openvas
openvas
Apache ActiveMQ Artemis < 1.4.0 RCE Vulnerability
2016-10-06 00:00:00
osv
osv
Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain
2022-05-13 01:11:53
github
github
Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain
2022-05-13 01:11:53
nvd
nvd
CVE-2016-4978
2016-09-27 15:59:01
CVE-2021-20318
2021-12-23 20:15:08
cvelist
cvelist
CVE-2016-4978
2016-09-27 15:00:00
CVE-2021-20318
2021-12-23 19:48:41
redhat
redhat
(RHSA-2017:1835) Important: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 7
2017-07-31 14:43:11
(RHSA-2017:1837) Important: eap7-jboss-ec2-eap security update
2017-07-31 15:08:24
(RHSA-2017:1834) Important: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 6
2017-07-31 14:42:46
redhatcve
redhatcve
CVE-2021-20318
2021-10-05 06:06:45
nessus
nessus
RHEL 7 : JBoss EAP (RHSA-2017:1835)
2017-08-03 00:00:00
RHEL 6 / 7 : eap7-jboss-ec2-eap (RHSA-2017:1837)
2017-08-03 00:00:00
RHEL 6 : JBoss EAP (RHSA-2017:1834)
2017-08-03 00:00:00

EPSS

0.017

Percentile

87.6%

JSON
Related for VERACODE:12527
prion2cve2openvas1osv1github1nvd2cvelist2redhat16redhatcve1nessus11