CVE-2017-12149

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 7, 2026

Description

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Red Hat, Inc.	jbossas	n/a

References

http://www.securityfocus.com/bid/100591Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:1607Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1608Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1486220Issue Tracking
https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149Third Party Advisory
http://www.securityfocus.com/bid/100591Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:1607Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1608Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1486220Issue Tracking
https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149US Government Resource

Timeline

Published: Oct 4, 2017
Last modified: Oct 7, 2026
Added to CISA KEV: Dec 10, 2021
NVD status: Analyzed

Related CVEs from 2017

CVE-2017-121507.4It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration CVE-2017-121517.4A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3 CVE-2017-121534.4A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This f CVE-2017-121547.1The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-st CVE-2017-121556.3A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world CVE-2017-121566.1Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.CVE-2017-121574.3In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.CVE-2017-121585.4It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker c CVE-2017-121597.5It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain ac CVE-2017-121607.2It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication serve CVE-2017-121618.8It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset reque CVE-2017-121637.1An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.