CVE-2010-1871 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows rem...
HighCVSS 8.8
EPSS 83.4%
CISA KEV
added 2021-12-10 · due 2022-06-10
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
CISA Known Exploited Vulnerability
- Date added
- 2021-12-10
- Due date (FCEB)
- 2022-06-10
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat jboss enterprise application platform | = 4.3.0 | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| netapp oncommand insight | All versions | No fix listed |
| netapp oncommand unified manager | All versions | No fix listed |
References
- 20130528 CA20130528-01: Security Notice for CA Process Automation (CA PAM) broken-link mailing-list
- RHSA-2010:0564 broken-link vendor-advisory
- 41994 broken-link third-party-advisory vdb-entry
- 1024253 broken-link third-party-advisory vdb-entry
- ADV-2010-1929 broken-link vdb-entry vendor-advisory
- bugzilla.redhat.com issue-tracking
- seam-expressions-code-execution(60794) third-party-advisory vdb-entry
- security.netapp.com third-party-advisory
- www.cisa.gov government-resource us-government-resource