Home > Vulnerability Database > CVE-2016-2510

Mend.io Vulnerability Database

CVE-2016-2510

Good to know:

Date: April 7, 2016

BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

Language: Java

Severity Score

8.1

Related Resources (23)

Url: http://rhn.redhat.com/errata/RHSA-2016-0539.html

Url: http://www.debian.org/security/2016/dsa-3504

Url: https://access.redhat.com/errata/RHSA-2016:1376

Url: https://nvd.nist.gov/vuln/detail/CVE-2016-2510

Url: https://access.redhat.com/errata/RHSA-2016:1135

Url: https://access.redhat.com/errata/RHSA-2019:1545

Url: https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf

Url: http://rhn.redhat.com/errata/RHSA-2016-0540.html

Url: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.html

Url: https://www.oracle.com/security-alerts/cpuoct2020.html

Url: https://security-tracker.debian.org/tracker/CVE-2016-2510

Url: https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced

Url: http://www.ubuntu.com/usn/USN-2923-1

Url: https://security.gentoo.org/glsa/201607-17

Url: https://github.com/frohoff/ysoserial/pull/13

Url: https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49

Url: http://www.securitytracker.com/id/1035440

Url: http://www.securityfocus.com/bid/84139

Url: https://github.com/beanshell/beanshell/releases/tag/2.0b6

Url: http://rhn.redhat.com/errata/RHSA-2016-2035.html

Url: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2016-2510

Url: https://www.mend.io/vulnerability-database/CVE-2016-2510

Severity Score

8.1

Weakness Type (CWE)

Data Handling

CWE-19

CVSS v3.1

Base Score:	8.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	6.8
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2016-2510

Good to know:

Date: April 7, 2016

Language: Java

Severity Score

Related Resources (23)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?