CVE-2016-0360

Critical

Published: 15/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

IBM Websphere MQ JMS client versions 7.0.1, 7.1, 7.5, 8.0, and 9.0 allow deserialization of objects from untrusted sources, which could enable a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath.

Risk Assessment

The risk associated with this vulnerability is the potential for remote code execution, which could lead to system compromise or data leakage.

Recommendation

It is recommended to update the IBM Websphere MQ JMS client to the latest version to mitigate this vulnerability and restrict classpath access to trusted sources.

Original NVD description (English source)

IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath. IBM Reference #: 1983457.