CVEvulnerability
CVE-2010-3708
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2010-12-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
Affected configurations
• redhat jboss enterprise application platform 4.3.0
• redhat jboss enterprise soa platform 4.2.0
• redhat jboss enterprise soa platform 4.3.0
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://securitytracker.com/id?1024813 securitytracker.com
- http://www.redhat.com/support/errata/RHSA-2010-0937.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0938.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0939.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0940.html Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=633859 bugzilla.redhat.com
- https://issues.jboss.org/browse/SOA-2319 issues.jboss.org
- http://securitytracker.com/id?1024813 securitytracker.com
- http://www.redhat.com/support/errata/RHSA-2010-0937.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0938.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0939.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0940.html Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=633859 bugzilla.redhat.com
- https://issues.jboss.org/browse/SOA-2319 issues.jboss.org