CVE-2016-6330

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-6330
The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:C

Exploitability : 10.0 / Impact : 8.5

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact COMPLETE

References
Link Resource
http://www.securityfocus.com/bid/92568 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1368864 Mitigation Issue Tracking Vendor Advisory
https://www.tenable.com/security/research/tra-2016-22
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.5:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.3.6:*:*:*:*:*:*:*
History

07 Nov 2023, 02:33

Type Values Removed Values Added
Summary The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737. The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.

13 Feb 2023, 04:50

Type Values Removed Values Added
References (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=1368864 - Issue Tracking, Mitigation, Vendor Advisory (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=1368864 - Mitigation, Issue Tracking, Vendor Advisory
Summary The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737. The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.
Information

Published : 2016-09-27 15:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-6330

Mitre link : CVE-2016-6330

CVE.ORG link : CVE-2016-6330

JSON object : View

Products Affected

redhat

  • jboss_operations_network
CWE
CWE-502

Deserialization of Untrusted Data