description: HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.
problem types: CWE-502
affected:
{
product: JBoss
vendor: Red Hat, Inc.
versions:
status: affected, version: 4.x
}