Threats tagged 'ghsa-cxvw-gvx2-4475'

A vulnerability in JBoss Enterprise Application Platform (EAP) occurs when running with the Java Security Manager enabled (-secmgr). The openjdk-orb's JDKBridge component improperly honors attacker-supplied CDR codebase URLs during object unmarshalling on TCP port 3528 (IIOP service). This allows an unauthenticated remote attacker to load and instantiate arbitrary classes from a remote URL within the server JVM before EJB security interceptors execute. Exploitation requires specific deployment conditions, notably exposure of the IIOP service and use of the Java Security Manager. Mitigation involves restricting access to port 3528 or disabling the IIOP subsystem if not needed.