CVE-2016-4974

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might…

published July 13, 2016

CVSS
—
EPSS
6%
Percentile
93.5
In the wild
Unconfirmed
What it is

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06245 · 93.5th percentile
Published
2016-07-13T15:00Z
EPSS history
Timeline
  • 13 JUL 15:00Z
    Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might…
    cvelistv5