Servers and applications
CVE-2013-1777
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
- Severity
- High 10.0
- Published
- 11 Jul 2013
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 9.8% in the next 30 daysHigher than 95% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- Code injection (CWE-94)
- Attack
- Over the network · No login needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
AV:N/AC:L/Au:N/C:C/I:C/A:C- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
IBM WebSphere Application ServerServers and applications · cpe:a:ibm:websphere_application_server |
|