CVE-2016-6330

Critical

Published: 27/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The server in Red Hat JBoss Operations Network (JON) allows remote attackers to execute arbitrary code via a crafted HTTP request when SSL authentication is not configured for server/agent communication. This vulnerability exists due to an incomplete fix for CVE-2016-3737.

Risk Assessment

Lack of proper SSL configuration may lead to serious security breaches, including remote code execution by attackers. Organizations may be at risk of data loss and other attacks.

Recommendation

It is recommended to configure SSL authentication for communication between the server and agent in JON. All available patches related to this vulnerability should also be applied.

Original NVD description (English source)

The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.