High severity · published May 6, 2016
CVE-2016-2094
The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a read-timeout…
7.5
CVSS
2.6%
EPSS
No
On KEV
Description
The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a read-timeout vulnerability.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Enterprise Application Platform · Jboss
6.4.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2094
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2094
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0595.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0596.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0597.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0598.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0599.html
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1308465
More from Enterprise Application Platform
–
CVE-2008-3273
JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed…