UpHeron
All vulnerabilities

Servers and applications

CVE-2016-4978

The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.

Severity
High 7.2
Published
27 Sept 2016
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.4.0
Exploit chance
6.9% in the next 30 daysHigher than 94% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Deserialization of untrusted data (CWE-502)
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Affected software

SoftwareAffected versions
Apache ActiveMQ ArtemisServers and applications · cpe:a:apache:artemis
  • Every version before 1.4.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-4978
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-4978