CVE-2016-5062

Critical

Published: 29/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, allowing remote attackers to execute arbitrary Java code by registering MBeans.

Risk Assessment

The lack of authentication poses a serious risk to the organization, enabling remote attackers to execute code, potentially leading to system compromise.

Recommendation

It is recommended to update Aternity to version 9.0.1 or later and implement appropriate authentication mechanisms for accessing MBeans.

Original NVD description (English source)

The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute arbitrary Java code by registering MBeans.