CVE Feed

    Dashboard / CVE / CVE-2016-2510

    CVE-2016-2510

    BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

    Published:Feb 22, 2016
    Last Modified:Apr 12, 2025
    EPS:Apr 7, 2016
    EPSS Score:0.34327
    CVSS Score:8.1

    Affected Products

    Vendor
    Beanshell
    Product
    Beanshell
    Vendor
    Canonical
    Product
    Ubuntu Linux
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Redhat
    Product
    Jboss Bpms
    Vendor
    Redhat
    Product
    Jboss Brms
    Vendor
    Redhat
    Product
    Jboss Data Virtualization
    Vendor
    Redhat
    Product
    Jboss Enterprise Soa Platform
    Vendor
    Redhat
    Product
    Jboss Fuse

    Exploits

    https://github.com/frohoff/ysoserial/pull/13https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdfhttps://github.com/frohoff/ysoserial/pull/13https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    References

    http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html
    http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.html
    http://rhn.redhat.com/errata/RHSA-2016-0539.html
    http://rhn.redhat.com/errata/RHSA-2016-0540.html
    http://rhn.redhat.com/errata/RHSA-2016-2035.html
    http://www.debian.org/security/2016/dsa-3504
    http://www.securityfocus.com/bid/84139
    http://www.securitytracker.com/id/1035440
    http://www.ubuntu.com/usn/USN-2923-1
    https://access.redhat.com/errata/RHSA-2016:1135
    https://access.redhat.com/errata/RHSA-2016:1376
    https://access.redhat.com/errata/RHSA-2019:1545
    https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced
    https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49
    https://github.com/beanshell/beanshell/releases/tag/2.0b6
    https://github.com/frohoff/ysoserial/pull/13
    https://security.gentoo.org/glsa/201607-17
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf
    http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html
    http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.html
    http://rhn.redhat.com/errata/RHSA-2016-0539.html
    http://rhn.redhat.com/errata/RHSA-2016-0540.html
    http://rhn.redhat.com/errata/RHSA-2016-2035.html
    http://www.debian.org/security/2016/dsa-3504
    http://www.securityfocus.com/bid/84139
    http://www.securitytracker.com/id/1035440
    http://www.ubuntu.com/usn/USN-2923-1
    https://access.redhat.com/errata/RHSA-2016:1135
    https://access.redhat.com/errata/RHSA-2016:1376
    https://access.redhat.com/errata/RHSA-2019:1545
    https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced
    https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49
    https://github.com/beanshell/beanshell/releases/tag/2.0b6
    https://github.com/frohoff/ysoserial/pull/13
    https://security.gentoo.org/glsa/201607-17
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High