vulnerability

Red Hat JBoss EAP: CVE-2025-2251: Deserialization of Untrusted Data

Severity
8
CVSS
(AV:N/AC:M/Au:M/C:P/I:C/A:C)
Published
Apr 7, 2025
Added
Apr 10, 2025
Modified
Jul 15, 2025

Description

A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.. A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.

Solution

red-hat-jboss-eap-upgrade-latest

References

    Title
    NEW

    Explore Exposure Command

    Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.