CVEvulnerability

CVE-2010-1871

8.8 HIGH Known exploited Published 2010-08-05 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability — Red Hat JBoss Seam 2

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.

Added to KEV: 2021-12-10
Remediation due: 2022-06-10
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2010-1871

Status: Analyzed
Published: 2010-08-05
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses: CWE-917

Description

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.

Affected configurations

• redhat jboss enterprise application platform 4.3.0 • netapp oncommand balance • netapp oncommand insight • netapp oncommand unified manager

Weakness · CWE (1)

CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References