Vulnerability details
CVE-2010-1871
Actively exploitedRed Hat JBoss Seam 2
CVSS 3.1
8.8High
Official description
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| No product information recorded. | |||
References and advisories
9- http://www.securityfocus.com/bid/41994 vdb-entryx_refsource_BID
- http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html mailing-listx_refsource_BUGTRAQ
- http://www.securitytracker.com/id?1024253 vdb-entryx_refsource_SECTRACK
- http://www.vupen.com/english/advisories/2010/1929 vdb-entryx_refsource_VUPEN
- https://bugzilla.redhat.com/show_bug.cgi?id=615956 x_refsource_CONFIRM
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60794 vdb-entryx_refsource_XF
- http://www.redhat.com/support/errata/RHSA-2010-0564.html vendor-advisoryx_refsource_REDHAT
- https://security.netapp.com/advisory/ntap-20161017-0001/ x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1871 government-resource
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2010-08-04
- Last updated
- 2025-10-22
- State
- Published
- Assigner (CNA)
- mitre
CISA KEV catalog
- Date added
- 2021-12-10
- Due date
- 2022-06-10
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
83.39%
Probability of exploitation in 30 days
99.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')