Evil-DB LogoEvil-DB
← All CVEs

CVE-2016-6330

critical · 9.8

The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.

9.8
CVSS
10.6%
EPSS (exploit prob.)
96th
EPSS percentile
2016-09-27
Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

VendorProductAffected versions
redhatjboss_operations_network3.0
redhatjboss_operations_network3.0.1
redhatjboss_operations_network3.1
redhatjboss_operations_network3.1.1
redhatjboss_operations_network3.1.2
redhatjboss_operations_network3.1.4
redhatjboss_operations_network3.2.0
redhatjboss_operations_network3.2.1
redhatjboss_operations_network3.2.2
redhatjboss_operations_network3.2.3
redhatjboss_operations_network3.3.1
redhatjboss_operations_network3.3.2
redhatjboss_operations_network3.3.3
redhatjboss_operations_network3.3.4
redhatjboss_operations_network3.3.5
redhatjboss_operations_network3.3.6

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-6330