What is the CVSS score of CVE-2016-4974?

CVE-2016-4974 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.1%.

Is there a patch available for CVE-2016-4974?

Yes, a patch is available for CVE-2016-4974. Update the affected software to the latest version immediately.

Amqp 0 X Jms Client CVE-2016-4974

HIGH

Improper Input Validation (CWE-20)

2016-07-13 secalert@redhat.com

RCE Apache Amqp 0 X Jms Client Jms Client Amqp

7.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jul 13, 2016 - 15:59 cve.org

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.apache.qpid:qpid-jms-client (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.10.0.

DescriptionCVE.org

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-20. Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function. Affected products include: Apache Amqp 0-X Jms Client, Apache Jms Client Amqp. Version information: before 6.0.4.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.