CVE-2010-1871
High · 8.8 CISA KEVCVSS
8.8
EPSS
83.4%
Published
Aug 5, 2010
CISA due date
Jun 10, 2022
The record
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-seam2 | 0 | 0:2.0.2.FP-1.ep1.24.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-seam2-docs | 0 | 0:2.0.2.FP-1.ep1.24.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-seam2 | 0 | 0:2.0.2.FP-1.ep1.24.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-seam2-docs | 0 | 0:2.0.2.FP-1.ep1.24.el5 |
Related vulnerabilities
- CVE-2013-2165 ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss… Also affects jboss-seam2
- CVE-2010-1428 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… Also affects jboss-seam2
- CVE-2010-0738 The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application… Also affects jboss-seam2
- CVE-2010-1429 Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before… Also affects jboss-seam2
- CVE-2009-2625 XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in… Also affects jboss-seam2
- CVE-2026-65591 n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's… CWE-917
- CVE-2026-57281 Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST… CWE-917
- CVE-2026-11561 Improper neutralization of special elements used in an expression language statement… CWE-917