CVE-2016-6330

The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.5:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.6:*:*:*:*:*:*:*

History

21 Nov 2024, 02:55

Type Values Removed Values Added
References () http://www.securityfocus.com/bid/92568 - Third Party Advisory () http://www.securityfocus.com/bid/92568 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=1368864 - Mitigation, Issue Tracking, Vendor Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=1368864 - Issue Tracking, Mitigation, Vendor Advisory
References () https://www.tenable.com/security/research/tra-2016-22 - () https://www.tenable.com/security/research/tra-2016-22 -

07 Nov 2023, 02:33

Type Values Removed Values Added
Summary The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737. The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.

Information

Published : 2016-09-27 15:59

Updated : 2024-11-21 02:55


NVD link : CVE-2016-6330

Mitre link : CVE-2016-6330

CVE.ORG link : CVE-2016-6330


JSON object : View

Products Affected

redhat

  • jboss_operations_network
CWE
CWE-502

Deserialization of Untrusted Data