Description
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
Remediation
References
https://issues.apache.org/jira/browse/GERONIMO-6477
http://geronimo.apache.org/30x-security-report.html
http://www-01.ibm.com/support/docview.wss?uid=swg21643282
http://archives.neohapsis.com/archives/bugtraq/2013-07/0008.html
Related Vulnerabilities
CVE-2023-37478 Vulnerability in npm package @pnpm/linuxstatic-arm64
CVE-2022-34196 Vulnerability in maven package io.jenkins.plugins:rest-list-parameter
CVE-2023-28682 Vulnerability in maven package org.jenkins-ci.plugins:perfpublisher
CVE-2017-7678 Vulnerability in maven package org.apache.spark:spark-core
CVE-2020-17510 Vulnerability in maven package org.apache.shiro:shiro-spring-boot-web-starter