CVE-2016-9606

8.1HIGH

Key Information:

Vendor
Red Hat
Status
Resteasy
Vendor
CVE Published:
9 March 2018

Summary

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.

Affected Version(s)

RESTEasy 3.1.2

References

https://access.redhat.com/errata/RHSA-2017:1411
vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2017-1409.html
vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/94940
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.