CVE-2013-1777

CWE-94 — Code Injection7 documents6 sources
Severity
10.0CRITICAL
EPSS
8.3%
top 7.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache GeronimoIBM Websphere Application Server
Timeline
PublishedJul 11
Latest updateMay 17

Description

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages3 packages

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

3
OSV
Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1↗2022-05-17
▶
GHSA
Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1↗2022-05-17
▶
CVEList
CVE-2013-1777: The JMX Remoting functionality in Apache Geronimo 3↗2013-07-11
▶

📋Vendor Advisories

1
Red Hat
geronimo: Improper RMI classloader implementation in JMX remoting functionality leading to arbitrary code execution↗2013-07-01
▶

💬Community

2
Bugzilla
CVE-2013-4169 gdm: TOCTTOU race condition on /tmp/.X11-unix↗2013-07-25
▶
Bugzilla
CVE-2013-1777 geronimo: Improper RMI classloader implementation in JMX remoting functionality leading to arbitrary code execution↗2013-07-12
▶
CVE-2013-1777 (CRITICAL CVSS 10) | The JMX Remoting functionality in A | cvebase.io