Search for vulnerabilities
| Vulnerability ID | VCID-ddps-ngjz-aaaf |
| Aliases |
CVE-2011-3556
|
| Summary | CVE-2011-3556 OpenJDK: RMI DGC server remote code execution (RMI, 7077466) |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 9.0 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| There are no known CWE. |
| Data source | Exploit-DB |
|---|---|
| Date added | July 16, 2011 |
| Description | Java RMI - Server Insecure Default Configuration Java Code Execution (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | July 15, 2011 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | June 5, 2017 |
| Data source | Metasploit |
|---|---|
| Description | This module takes advantage of the default configuration of the RMI Registry and RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it invokes a method in the RMI Distributed Garbage Collector which is available via every RMI endpoint, it can be used against both rmiregistry and rmid, and against most other (custom) RMI endpoints as well. Note that it does not work against Java Management Extension (JMX) ports since those do not support remote class loading, unless another RMI endpoint is active in the same Java process. RMI method calls do not support or require any sort of authentication. |
| Note | {}
|
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 15, 2011 |
| Platform | Java,Linux,OSX,Solaris,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/misc/java_rmi_server.rb |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Percentile | 0.97755 |
| EPSS Score | 0.55778 |
| Published At | Nov. 1, 2024, midnight |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| There are no relevant records. | ||||