NetSight
IP …
high8.8Known exploitedPublic exploit code

CVE-2010-1871

Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-12-10. Federal due date: 2022-06-10.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.

Affected products

VendorProductAffected versions
RedhatJboss Enterprise Application Platform
Version 4.3.0
NetappOncommand Balance
All versions
NetappOncommand Insight
All versions
NetappOncommand Unified Manager
All versions

Weakness classification

CWE-917

References