Actively exploited · Published Aug 4, 2010 · Assigned by mitre
CVE-2010-1871
High 8.8 Exploited
In plain English
A high-severity expression language injection in JBoss Seam 2 from Red Hat. Attackers are actively exploiting it in the wild (listed by CISA on December 10, 2021). The chance it is exploited in the next 30 days is estimated at 83.4% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 10, 2022.
Official description
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
Affected products (as reported)
Weakness: CWE-917 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- 41994 vdb-entry, x_refsource_BID
- 20130528 CA20130528-01: Security Notice for CA Process Automation (CA PAM) mailing-list, x_refsource_BUGTRAQ
- 1024253 vdb-entry, x_refsource_SECTRACK
- ADV-2010-1929 vdb-entry, x_refsource_VUPEN
- https://bugzilla.redhat.com/show_bug.cgi?id=615956 x_refsource_CONFIRM
- seam-expressions-code-execution(60794) vdb-entry, x_refsource_XF
- RHSA-2010:0564 vendor-advisory, x_refsource_REDHAT
- https://security.netapp.com/advisory/ntap-20161017-0001/ x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1871 government-resource