| Vulnerability Name: | CVE-2013-1777 (CCN-85423) | ||||||||
| Assigned: | 2013-07-01 | ||||||||
| Published: | 2013-07-01 | ||||||||
| Updated: | 2014-04-01 | ||||||||
| Summary: | The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object. | ||||||||
| CVSS v3 Severity: | 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C) 7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
7.4 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-94 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: BUGTRAQ Type: UNKNOWN 20130701 [SECURITY] CVE-2013-1777: Apache Geronimo 3 RMI classloader exposure Source: MITRE Type: CNA CVE-2013-1777 Source: CCN Type: Apache Geronimo Web page Apache Geronimo 3.0.x vulnerabilities Source: CONFIRM Type: Vendor Advisory http://geronimo.apache.org/30x-security-report.html Source: CCN Type: SA53978 Apache Geronimo Serialized Object Handling Vulnerability Source: CONFIRM Type: Patch, Vendor Advisory http://www-01.ibm.com/support/docview.wss?uid=swg21643282 Source: CCN Type: BID-60875 Apache Geronimo RMI Classloader Security Bypass Vulnerability Source: XF Type: UNKNOWN apache-geronimo-cve20131777-code-exec(85423) Source: CONFIRM Type: UNKNOWN https://issues.apache.org/jira/browse/GERONIMO-6477 Source: CCN Type: WhiteSource Vulnerability Database CVE-2013-1777 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||