CVE-2016-4978
Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain
7.2
HIGH
CVSS 3.1
EPSS 1.4%
Description
The getObject method of the `javax.jms.ObjectMessage` class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
How to fix CVE-2016-4978
To remediate CVE-2016-4978, upgrade the affected package to a fixed version below.
- —upgrade to 1.4.0 or later
Is CVE-2016-4978 being exploited?
Low — EPSS is 1.4%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1.4.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |