CVE-2010-1871

HIGH8.8

CISA KEVHigh EPSS

Description

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

NETAPP / oncommand_balance
NETAPP / OnCommand Insight
NETAPP / OnCommand Unified Manager
RedHat / jboss_enterprise_application_platform4.3.0 – 4.3.0

References

MISChttp://www.securityfocus.com/bid/41994
MISChttp://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html
MISChttp://www.securitytracker.com/id?1024253
VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2010/1929
MISChttps://bugzilla.redhat.com/show_bug.cgi?id=615956
MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/60794
MISChttp://www.redhat.com/support/errata/RHSA-2010-0564.html
MISChttps://security.netapp.com/advisory/ntap-20161017-0001/