High severity · published Aug 4, 2010
CVE-2010-1871
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
In wildKEV
8.8
CVSS
83.4%
EPSS
Yes
On KEV
Description
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)83.4% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 10, 2021
Federal remediation dueJun 10, 2022
Ransomware campaign useNot known
Affected products
Which versions
JE
Jboss Enterprise Application Platform · Redhat
4.3.0 · source: NVD
OB
Oncommand Balance · Netapp
All versions, or not specified · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
OU
Oncommand Unified Manager · Netapp
All versions, or not specified · source: NVD
JS
JBoss Seam 2 · Red Hat
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-1871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-1871
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Broken Link
http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html
Broken Link
http://www.redhat.com/support/errata/RHSA-2010-0564.html
Broken Link
http://www.securityfocus.com/bid/41994
Broken Link
http://www.securitytracker.com/id?1024253
Broken Link
http://www.vupen.com/english/advisories/2010/1929
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=615956
More from Oncommand Balance
9.8
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload…
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g
8.1
CVE-2017-9805
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type…