CVE-2013-1777

EPSS 8.3%

Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1

發布日:2022/5/17修改日:2024/12/3

描述

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.

受影響套件(1)

Maven/org.apache.geronimo.framework:geronimo-jmx-remoting>= 3.0-beta-1, < 3.0.1

參考連結(9)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2013-1777
PATCHhttps://github.com/apache/geronimo
WEBhttp://archives.neohapsis.com/archives/bugtraq/2013-07/0008.html
WEBhttp://geronimo.apache.org/30x-security-report.html
WEBhttps://github.com/apache/geronimo/commit/ee031c5e62b0d358250d06c2aa6722518579a6c5
WEBhttps://issues.apache.org/jira/browse/GERONIMO-6477
WEBhttp://svn.apache.org/viewvc/geronimo/server/trunk
WEBhttp://svn.apache.org/viewvc?view=revision&revision=1458113
WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21643282