CVE-2016-4978

HighCVSS 7.2

Published: 27/09/2016(UTC)Updated: 15/06/2026(UTC)Translated: 16/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

6.92%

93th percentile - higher than 93% of all known CVEs

Summary

The getObject method of the javax.jms.ObjectMessage class in Apache ActiveMQ Artemis before version 1.4.0 may allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code.

Risk Assessment

Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to the security of the system and the organization's data.

Recommendation

It is recommended to upgrade Apache ActiveMQ Artemis to version 1.4.0 or later to mitigate this vulnerability.

Original NVD description (English source)

The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.