PT-2010-1176 · Red Hat · Jboss Seam 2+1

Meder Kydyraliev · Published 2010-08-04 · Updated 2025-02-10 · CVE-2010-1871

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JBoss Seam 2 versions 2.0 through 2.3 JBoss Enterprise Application Platform version 4.3.0

Description The issue is related to the improper sanitization of inputs for JBoss Expression Language (EL) expressions in JBoss Seam 2, which can be exploited by remote attackers to execute arbitrary code via a crafted URL. This is only considered a vulnerability when the Java Security Manager is not properly configured.

Recommendations For JBoss Seam 2 versions 2.0 through 2.3, ensure the Java Security Manager is properly configured to mitigate the risk of exploitation. For JBoss Enterprise Application Platform version 4.3.0, consider implementing additional security measures to restrict access to vulnerable components until a proper configuration of the Java Security Manager can be achieved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-917

CWE-20

Related Identifiers

BDU:2022-04006

CVE-2010-1871

RHSA-2010:0564

Affected Products

Red Hat Jboss Enterprise Application Platform

Jboss Seam 2

References · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_seam_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_seam_upload_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/36653 · Exploit
• http://vupen.com/english/advisories/2010/1929 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0564.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1871 · Security Note
• https://bdu.fstec.ru/vul/2022-04006 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1871 · Note
• http://securitytracker.com/id?1024253 · Note
• http://securityfocus.com/bid/41994 · Note
• https://security.netapp.com/advisory/ntap-20161017-0001 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60794 · Note
• https://t.me/cvenotify/104936 · Telegram Post
• https://t.me/cvenotify/87282 · Telegram Post