Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1

CRITICAL 10.0CVE-2013-1777 · GHSA-v64w-96p6-fx7w · Published 11/07/2013 · updated 16/06/2026

In short

CVE-2013-1777 is a CRITICAL (CVSS 10.0) vulnerability affecting org.apache.geronimo.framework:geronimo-jmx-remoting, geronimo (apache), websphere application server (ibm).
Chance of exploitation in the next 30 days (EPSS): 9.8%, higher than 95.5% of all vulnerabilities.
Fix: update to 3.0.1 or later.

Package	Affected versions	Patched versions
org.apache.geronimo.framework:geronimo-jmx-remoting Maven	`≥ 3.0-beta-1, < 3.0.1`	`3.0.1`
geronimo apache	`= 3.0`	No fix yet
websphere application server ibm	`= 3.0.0.3`	No fix yet

Description

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-1777 · ADVISORY
apache/geronimo commit ee031c5 · WEB
apache/geronimo · PACKAGE
issues.apache.org/jira/browse/GERONIMO-6477 · WEB
archives.neohapsis.com/archives/bugtraq/2013-07/0008.html · WEB
geronimo.apache.org/30x-security-report.html · WEB
svn.apache.org/viewvc/geronimo/server/trunk · WEB
svn.apache.org/viewvc · WEB
www-01.ibm.com/support/docview.wss · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.geronimo.framework:geronimo-jmx-remoting

Maven

≥ 3.0-beta-1, < 3.0.1

3.0.1

geronimo

apache

= 3.0

No fix yet

websphere application server

ibm

= 3.0.0.3

No fix yet

Description

NVD description