# CVE-2017-12149

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

- Page: https://www.vulneraibility.com/cve/CVE-2017-12149
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2021-12-10; CISA due date 2022-06-10; known ransomware use
- EPSS: 90.71% (percentile 99.8)
- Unvetted proof-of-concept code on GitHub: 1 Metasploit module · 11 GitHub proofs of concept · 1 Nuclei template (first 2017-11-21)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2026-08-13)
- Weakness: CWE-502
- Published: 2017-10-04

## Affected

- redhat:jboss_enterprise_application_platform

## References

- [other] https://bugzilla.redhat.com/show_bug.cgi?id=1486220
- [advisory] https://access.redhat.com/errata/RHSA-2018:1608
- [other] https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149
- [other] http://www.securityfocus.com/bid/100591
- [advisory] https://access.redhat.com/errata/RHSA-2018:1607
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.