CVE-2016-0779

Опубликовано: 11 апр. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.

Ссылки

http://packetstormsecurity.com/files/136256/Apache-TomEE-Patched.html
Third Party Advisory
VDB Entry
http://tomee-openejb.979440.n4.nabble.com/Document-resolved-vulnerability-CVE-2015-8581-td4678073.html
Issue Tracking
http://tomee.apache.org/security/tomee.html
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/537806/100/0/threaded
http://www.securityfocus.com/bid/79204
Third Party Advisory
VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-15-638
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/136256/Apache-TomEE-Patched.html
Third Party Advisory
VDB Entry
http://tomee-openejb.979440.n4.nabble.com/Document-resolved-vulnerability-CVE-2015-8581-td4678073.html
Issue Tracking
http://tomee.apache.org/security/tomee.html
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/537806/100/0/threaded
http://www.securityfocus.com/bid/79204
Third Party Advisory
VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-15-638
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*

Версия до 1.7.3 (включая)

cpe:2.3:a:apache:tomee:7.0.0:m1:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.04965

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-502

Связанные уязвимости

GHSA-g7jw-7782-jjv9

CVSS3: 9.8

github

больше 3 лет назад