CVE-2016-3737: Input Validation
JBoss Operations Network server deserializes data, and does not require authentication. A malicious payload could be crafted, and sent to a server which when deserialized causes remote code execution.
Other sources
The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3737?
CVE-2016-3737 is rated as critical due to its potential for remote code execution.
How do I fix CVE-2016-3737?
To fix CVE-2016-3737, upgrade to Red Hat JBoss Operations Network version 3.3.6 or later.
What kind of attack is possible with CVE-2016-3737?
CVE-2016-3737 allows remote attackers to send malicious payloads for remote code execution through deserialization.
Which versions of JBoss Operations Network are affected by CVE-2016-3737?
JBoss Operations Network versions prior to 3.3.6, specifically up to version 3.3.5, are affected by CVE-2016-3737.
Does CVE-2016-3737 require authentication to exploit?
CVE-2016-3737 does not require authentication, making it easier for attackers to exploit.