CVE-2017-7504

Critical

Published: 19/05/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The HTTPServerILServlet.java in the JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server versions up to 4.X, does not restrict the classes for which it performs deserialization. This allows remote attackers to execute arbitrary code via crafted serialized data.

Risk Assessment

This vulnerability poses a serious risk to organizations by allowing remote attackers to run unauthorized code, potentially leading to system compromise.

Recommendation

It is recommended to upgrade to a newer version of Jboss Application Server that addresses this vulnerability and to implement additional security measures to restrict access to the server.

Original NVD description (English source)

HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.