Deserialization in Apache Software Foundation Karaf
CVE-2016-8648
It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user ru…
Vulnerability class: Insecure Deserialization
EPSS: 0.020 (78.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Software Foundation Karaf — versions As shipped with Jboss Fuse 6.x
- Redhat Jboss_a-mq — versions 6.0.0
- Redhat Jboss_fuse — versions 6.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Mitigation, Issue Tracking)
Frequently asked questions
- What is CVE-2016-8648?
- CVE-2016-8648 is a high-severity vulnerability in Apache Software Foundation Karaf, classified under Deserialization of Untrusted Data. CVSS score: 7.2/10. Published 2018-08-01.
- How severe is CVE-2016-8648?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2016-8648 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.