CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated attackers to exploit the openjdk-orb's JDKBridge when EAP runs with -secmgr, enabling them to load and instantiate arbitrary classes from remote URLs during object unmarshalling. This poses a significant risk as it can lead to remote code execution before EJB security measures are applied. Organizations using affected versions of EAP should prioritize patching this vulnerability to mitigate potential exploitation.
Original NVD Description
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.