Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-2510

BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

Published

2016-04-07T20:59:05.567

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Primary
CWE-19

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	beanshell	beanshell	1.0	Yes
Application	beanshell	beanshell	2.0	Yes
Application	beanshell	beanshell	2.0	Yes
Application	beanshell	beanshell	2.0	Yes
Operating System	debian	debian_linux	7.0	Yes
Operating System	debian	debian_linux	8.0	Yes
Operating System	canonical	ubuntu_linux	12.04	Yes
Operating System	canonical	ubuntu_linux	14.04	Yes
Operating System	canonical	ubuntu_linux	15.10	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.html Mailing List, Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2016-0539.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2016-0540.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2016-2035.html Third Party Advisory ([email protected])
http://www.debian.org/security/2016/dsa-3504 Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/84139 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1035440 Third Party Advisory, VDB Entry ([email protected])
http://www.ubuntu.com/usn/USN-2923-1 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2016:1135 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2016:1376 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2019:1545 Third Party Advisory ([email protected])
https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced Patch, Third Party Advisory ([email protected])
https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49 Patch, Third Party Advisory ([email protected])
https://github.com/beanshell/beanshell/releases/tag/2.0b6 Patch, Third Party Advisory ([email protected])
https://github.com/frohoff/ysoserial/pull/13 Exploit, Third Party Advisory ([email protected])
https://security.gentoo.org/glsa/201607-17 Third Party Advisory ([email protected])
https://www.oracle.com/security-alerts/cpuoct2020.html ([email protected])
https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf Exploit, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2016-0539.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2016-0540.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2016-2035.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2016/dsa-3504 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/84139 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1035440 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-2923-1 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2016:1135 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2016:1376 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2019:1545 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/beanshell/beanshell/releases/tag/2.0b6 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/frohoff/ysoserial/pull/13 Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/201607-17 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuoct2020.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)