CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2016-4978

The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.012

EPSS Ranking 77.5%

CVSS Severity

CVSS v3 Score 7.2

CVSS v2 Score 6.0

References

Products affected by CVE-2016-4978

Apache » Activemq Artemis » Version: N/A

cpe:2.3:a:apache:activemq_artemis:-
Apache » Activemq Artemis » Version: 1.0.0

cpe:2.3:a:apache:activemq_artemis:1.0.0
Apache » Activemq Artemis » Version: 1.1.0

cpe:2.3:a:apache:activemq_artemis:1.1.0
Apache » Activemq Artemis » Version: 1.2.0

cpe:2.3:a:apache:activemq_artemis:1.2.0
Apache » Activemq Artemis » Version: 1.3.0

cpe:2.3:a:apache:activemq_artemis:1.3.0
Redhat » Jboss Enterprise Application Platform » Version: 6.0.0

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0
Redhat » Jboss Enterprise Application Platform » Version: 6.4.0

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0
Redhat » Jboss Enterprise Application Platform » Version: 7.0.0

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0
Redhat » Jboss Enterprise Application Platform » Version: 7.1.0

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0
Redhat » Enterprise Linux Server » Version: 5.0

cpe:2.3:o:redhat:enterprise_linux_server:5.0
Redhat » Enterprise Linux Server » Version: 6.0

cpe:2.3:o:redhat:enterprise_linux_server:6.0
Redhat » Enterprise Linux Server » Version: 7.0

cpe:2.3:o:redhat:enterprise_linux_server:7.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2016-4978

Products

Pricing

Contact Us