Description (CNA)
HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat, Inc. / JBoss | affected 4.x |
CWE
CWE-502
References
ADP enrichment
No English description supplied.