CVE-2016-3737

CWE-20 — Improper Input Validation9 documents7 sources
Severity
9.8CRITICAL
EPSS
0.6%
top 30.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Jboss Operations Network
Timeline
PublishedAug 2
Latest updateMay 17

Description

The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-m68x-f3rw-rxhq: The server in Red Hat JBoss Operations Network (JON) before 3↗2022-05-17
▶
CVEList
CVE-2016-3737: The server in Red Hat JBoss Operations Network (JON) before 3↗2016-08-02
▶

📋Vendor Advisories

2
Red Hat
JON: incomplete fix for CVE-2016-3737↗2016-08-22
▶
Red Hat
JON: The agent/server communication deserializes data, and does not require authentication↗2016-05-06
▶

🕵️Threat Intelligence

1
Tenable
Expanding on a Known Vulnerability: Attacking with Jython↗2016-09-07
▶

💬Community

2
Bugzilla
CVE-2016-6330 JON: incomplete fix for CVE-2016-3737↗2016-08-22
▶
Bugzilla
CVE-2016-3737 JON: The agent/server communication deserializes data, and does not require authentication↗2016-05-06
▶