VIR Vulnerability Intelligence Relay

CVE-2016-6330

critical
Published 2016-09-27 · Modified 2026-05-06
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
9.0
VIR risk
9.8

Description

The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://bugzilla.redhat.com/show_bug.cgi?id=1368864

Application impact
VendorProductVersionsFixed
redhat redhatjboss_operations_network3.0
redhat redhatjboss_operations_network3.0.1
redhat redhatjboss_operations_network3.1
redhat redhatjboss_operations_network3.1.1
redhat redhatjboss_operations_network3.1.2
redhat redhatjboss_operations_network3.1.4
redhat redhatjboss_operations_network3.2.0
redhat redhatjboss_operations_network3.2.1
redhat redhatjboss_operations_network3.2.2
redhat redhatjboss_operations_network3.2.3
redhat redhatjboss_operations_network3.3.1
redhat redhatjboss_operations_network3.3.2
redhat redhatjboss_operations_network3.3.3
redhat redhatjboss_operations_network3.3.4
redhat redhatjboss_operations_network3.3.5
redhat redhatjboss_operations_network3.3.6

References

CWEs

CWE-502

Verify integrity in audit chain (admin only). AS-IS.