GitHub Advisoryadvisory · Maven

GHSA-qvq6-cw53-rmwg Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP

HIGH Published 2022-05-17 Modified 2022-11-22 Official page ↗
Aliases
CVE-2010-3708
Ecosystem
Maven
Packages
org.drools:drools-core
Severity
High
Weaknesses
CWE-20
Reviewed
2022-11-22

Affected packages

• Maven org.drools:drools-core: < 4.0.7 → fixed in 4.0.7

Description

The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer. The maintainers of JBoss EAP patched the vulnerability by applying a fix from Drools 4.0.7.

Related

Alias · CVE (1)

  • CVE-2010-3708 The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References