CVE-2017-12149: Red Hat JBoss Application Server Remote Code Execution Vulnerability
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
Published Oct 4, 2017 · Updated Oct 7, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Red Hat vulnerabilities
All Red Hat entriesCVE-2021-3560
Red Hat Polkit Incorrect Authorization Vulnerability
high7.8ExploitedFeb 16, 2022CVE-2021-4034
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
high7.8ExploitedJan 28, 2022CVE-2018-14667
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
critical9.8ExploitedNov 6, 2018CVE-2015-5287
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
high7.8ExploitedDec 7, 2015CVE-2015-3246
Red Hat Libuser Race Condition Vulnerability
high7.4ExploitedAug 11, 2015CVE-2010-1871
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
high8.8ExploitedAug 5, 2010