CVE Catalog
CVE-2016-0779
CriticalSummary
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
Risk Assessment
An attacker can exploit this vulnerability to execute remote code, potentially leading to system compromise or data leakage.
Recommendation
It is recommended to upgrade Apache TomEE to the latest version to mitigate this vulnerability.
Original NVD description (English source)
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.