CVE-2016-3690: Critical severity jboss enterprise application platform vulnerability
The HA Pooled Invoker allows unauthorised access, and deserializes any payload sent to it.
This is one of the attack vectors for CVE-2015-7501. There are many new gadget chains available in the ysoserial project. For example the Beanshell library could be used to create a malicious serialized object. When deserialized by the HA Pooled Invoker servlet allows remote code execution.
Other sources
The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3690?
CVE-2016-3690 is considered a critical vulnerability due to unauthorized access and dangerous deserialization issues.
How do I fix CVE-2016-3690?
To fix CVE-2016-3690, you need to update your Red Hat JBoss Enterprise Application Platform to a version that is patched against this vulnerability.
What versions are affected by CVE-2016-3690?
CVE-2016-3690 affects Red Hat JBoss Enterprise Application Platform versions 4.2.0, 4.3.0, 5.0.0, 5.1.0, 5.1.1, 5.1.2, and 5.2.0.
What should I do if I cannot upgrade to a fixed version for CVE-2016-3690?
If upgrading is not possible, consider implementing security measures such as network access controls and application-level security to mitigate the risk from CVE-2016-3690.
Is CVE-2016-3690 related to any other vulnerabilities?
Yes, CVE-2016-3690 is one of the attack vectors for CVE-2015-7501, indicating an interconnected vulnerability scenario.