{"id":"CVE-2017-12149","kind":"vulnerability","aliases":["CVE-2017-12149"],"related":[],"title":"Red Hat JBoss Application Server: Red Hat JBoss Application Server Remote Code Execution Vulnerability","description":"In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.","summary":"JBoss Application Server shipped with Red Hat Enterprise Application Platform 5.2 deserializes crafted serialized data without checks. An unauthenticated attacker who sends such data can execute arbitrary code on the server.","severity":"critical","cvss":9.8,"epss":0.90713,"exploited":true,"exploited_at":"2021-12-10T00:00:00+00:00","products":[{"name":"Red Hat JBoss Application Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","jboss","ransomware","red-hat-eap","runtime"],"not_affected_if":["not-deserialization-endpoint-exposed","not-eap-5.2"],"how_to_check":null,"fix":"Apply the Red Hat update for JBoss Application Server per vendor instructions (CISA required action); the specific patched version is unknown from the sources.","status":"open","published_at":"2017-10-04T21:01:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:52+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:31:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Red Hat update for JBoss Application Server per vendor instructions (CISA required action); the specific patched version is unknown from the sources.","reach":"network","impact":"high","summary":"JBoss Application Server shipped with Red Hat Enterprise Application Platform 5.2 deserializes crafted serialized data without checks. An unauthenticated attacker who sends such data can execute arbitrary code on the server.","category":"runtime","who_cares":["jboss","red-hat-eap","java"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the application server.","analyst_note":"Find the Red Hat advisory and patched EAP 5.2 versions, plus the exposed endpoint and any auth requirement, via the CISA KEV entry and Red Hat security data for CVE-2017-12149.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-eap-5.2","not-deserialization-endpoint-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000482,"input_tokens":2856,"output_tokens":393,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the Red Hat advisory and patched EAP 5.2 versions, plus the exposed endpoint and any auth requirement, via the CISA KEV entry and Red Hat security data for CVE-2017-12149.","search":"'-12149':17A,20A '-2017':16A,19A '5.2':45B,78C 'allow':104C 'applic':4A,9A,36B,43B,68C,76C 'application':24A 'arbitrari':61B,109C 'attack':54B,106C 'check':51B 'class':96C 'code':12A,62B,110C 'craft':47B,112C 'cve':15A,18A 'data':49B,58B,114C 'deseri':46B,101C 'dofilt':84C 'eap':33B 'enterpris':42B,75C 'execut':13A,60B,108C 'exploit':26B 'found':81C 'hat':2A,7A,22A,32B,41B,74C 'http':91C 'invok':92C 'java':27B 'jboss':3A,8A,23A,28B,35B,67C 'method':85C 'perform':100C 'platform':44B,77C 'ransomwar':29B 'readonlyaccessfilt':88C 'red':1A,6A,21A,31B,40B,73C 'red-hat-eap':30B 'remot':11A 'restrict':95C 'runtim':34B 'send':56B 'serial':48B,113C 'server':5A,10A,25A,37B,65B,69C 'ship':38B,71C 'thus':103C 'unauthent':53B 'via':111C 'vulner':14A 'without':50B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-10-04T21:01:00+00:00","kev":{"dateAdded":"2021-12-10","dueDate":"2022-06-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-12149","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12149","severity":null,"published_at":"2021-12-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2017-12149","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12149","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-12149","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12149","severity":null,"published_at":"2017-10-04T21:01:00+00:00","modified_at":"2026-10-07T17:58:24+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}