CVE-2017-12149
Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- Red Hat JBoss Application Server Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 91% (percentile: 100) as of 1 November 2026
- CWE
- CWE-502
Affected products
redhat: jboss enterprise application platform
References
- http://www.securityfocus.com/bid/100591 Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:1607 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1608 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1486220 Issue Tracking
- https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149 Third Party Advisory
- http://www.securityfocus.com/bid/100591 Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:1607 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1608 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1486220 Issue Tracking
- https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149 Third Party Advisory