NVD

Id
18723  
Name
CVE-2016-2510  
Description
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-04-07  
Modified Date
2016-12-02  
Seq
2016-2510  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
103416 18723 CVE-2016-2510 openSUSE-SU-2016:0788  View
103417 18723 CVE-2016-2510 openSUSE-SU-2016:0833  View
103418 18723 CVE-2016-2510 RHSA-2016:0539  View
103419 18723 CVE-2016-2510 RHSA-2016:0540  View
103420 18723 CVE-2016-2510 DSA-3504  View
103421 18723 CVE-2016-2510 84139  View
103422 18723 CVE-2016-2510 1035440  View
103423 18723 CVE-2016-2510 USN-2923-1  View
103424 18723 CVE-2016-2510 RHSA-2016:1135  View
103425 18723 CVE-2016-2510 https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced  View
103426 18723 CVE-2016-2510 https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49  View
103427 18723 CVE-2016-2510 https://github.com/beanshell/beanshell/releases/tag/2.0b6  View
103428 18723 CVE-2016-2510 https://github.com/frohoff/ysoserial/pull/13  View
103429 18723 CVE-2016-2510 GLSA-201607-17  View
103430 18723 CVE-2016-2510 https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1342 JVNDB-2016-002115 BeanShell における任意のコードを実行される脆弱性 BeanShell (bsh) には、Java シリアライゼーションまたは XStream を使用するアプリケーションによってクラスパスに含まれる場合、XThis.Handler に関する処理に不備があるため、任意のコードを実行される脆弱性が存在します。 CVE-2016-2510 89016 CVE-2016-2510 18723 6.8 8.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002115.html 2016-02-18 2016-06-14 View