CVE-2016-9585
published 2018-03-09CVE-2016-9585: Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. An…
PriorityP422medium5.3CVSS 3.0
AVNACHPRNUIRSUCNINAH
EPSS
1.12%
62.5th percentile
Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. An attacker could exploit this vulnerability resulting in a denial of service attack.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat_inc | eap-5 | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:N/A:P
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h2jh-xp68-gwgf: Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it
ghsa_unreviewed·2022-05-13
CVE-2016-9585 [MEDIUM] CWE-502 GHSA-h2jh-xp68-gwgf: Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it
Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. An attacker could exploit this vulnerability resulting in a denial of service attack.
Red Hat
EAP-5: unsafe deserialization of user credentials by the JMX endpoint
vendor_redhat·2016-12-14·CVSS 5.3
CVE-2016-9585 [MEDIUM] EAP-5: unsafe deserialization of user credentials by the JMX endpoint
EAP-5: unsafe deserialization of user credentials by the JMX endpoint
Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. An attacker could exploit this vulnerability resulting in a denial of service attack.
It was found that the JMX endpoint of Red Hat JBoss EAP 5 deserializes the credentials passed to it. An attacker could use this flaw to cause a denial of service.
Mitigation: You should not expose Remote JMX on EAP 5, or SOA-P 5. To do that remove this system property from bin/run.conf, or bin/run.conf.bat:
com.sun.management.jmxremote.port=
Package: jbossas (Red Hat JBoss Enterprise Application Platform 5) - Will not fix
Package: jbossas (Red Hat JBoss SOA Platform 5) - Will not fix
No detection rules found.
No public exploits indexed.
2018-03-09
Published