Red Hat · JBoss Seam 2
CVE-2010-1871
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
What it is
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
CISA: JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 10, 2022
- Added to the CISA list
- December 10, 2021
- Published
- August 4, 2010
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 83% in the top 0.3% of all known vulnerabilities
- Weakness
- CWE-20
- More details
- NVD · CVE.org · CISA
All references (8)
- http://www.redhat.com/support/errata/RHSA-2010-0564.html
- http://www.securityfocus.com/bid/41994
- http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html
- http://www.securitytracker.com/id?1024253
- http://www.vupen.com/english/advisories/2010/1929
- https://bugzilla.redhat.com/show_bug.cgi?id=615956
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60794
- https://security.netapp.com/advisory/ntap-20161017-0001/
More exploited flaws from Red Hat
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 26, 2026 | Race Condition | Libuser | High 7.4 | 8.5% |
| Aug 26, 2026 | Privilege Escalation | Automatic Bug Reporting Tool | High 7.8 | 5.0% |
| Sep 28, 2023 | Expression Language Injection | JBoss RichFaces Framework | Critical 9.8 | 74% |
| May 12, 2023 | Incorrect Authorization | Polkit | High 7.8 | 24% |
| Jun 27, 2022 | Out-of-Bounds Read and Write | Polkit | High 7.8 | 95% |
| May 25, 2022 | Authentication Bypass | JBoss | Low 3.7 | 74% |
| May 25, 2022 | Information Disclosure | JBoss | Medium 5.9 | 53% |
| Dec 10, 2021 | Remote Code Execution | JBoss Application Server | Critical 9.8 | 91% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.