{"id":"CVE-2019-4279","published":"2019-05-17T15:20:16Z","modified":"2024-09-17T01:45:50Z","title":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system…","vendor":"IBM","product":"WebSphere Application Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"IBM","product":"WebSphere Application Server","versions":["8.5","9.0"]}],"description":{"text":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.","provenance":"source","from":"CVE.org"},"summary":{"text":"IBM WebSphere Application Server versions 8.5 and 9.0 contain a deserialization flaw in how the server processes serialized objects. A remote attacker who sends a specially crafted sequence of serialized objects from an untrusted source can execute arbitrary code on the system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:47Z"},"cvss":{"score":9,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/S:C/A:H/AC:H/I:H/C:H/AV:N/PR:N/UI:N/RL:O/RC:C/E:U","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.79926,"percentile":0.99609,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.ibm.com/support/docview.wss?uid=ibm10883628","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/160445","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.securityfocus.com/bid/108450","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-13886","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13886","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46969,"url":"https://www.exploit-db.com/exploits/46969","title":"IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit)","type":"remote","platform":"windows","date":"2019-06-05","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-06-05"},"metasploit":[{"name":"IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution","module":"exploit/windows/ibm/ibm_was_dmgr_java_deserialization_rce","type":"exploit","disclosureDate":"2019-05-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ibm/ibm_was_dmgr_java_deserialization_rce.rb"}],"first":{"date":"2019-05-15","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ibm/ibm_was_dmgr_java_deserialization_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2019-05-15","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-06-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ibm/ibm_was_dmgr_java_deserialization_rce.rb","provenance":"source"},{"date":"2019-05-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-4279","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":31.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9961"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.3,"detail":"base score 9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}