CVE-2010-3708
Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
Exploit likelihood
What each source reports
NVD Score used
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
- Record
CVE-2010-3708- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
- Record
CVE-2010-3708- Updated
- 2026-11-02
EUVDEUVD-2022-5038 No score
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
- Record
EUVD-2022-5038- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qvq6-cw53-rmwg No score
Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
The maintainers of JBoss EAP patched the vulnerability by applying a fix from Drools 4.0.7.
- Record
GHSA-qvq6-cw53-rmwg- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-qvq6-cw53-rmwg No score
Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
The maintainers of JBoss EAP patched the vulnerability by applying a fix from Drools 4.0.7.
- Record
GHSA-qvq6-cw53-rmwg- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.drools:drools-coreMaven |
before 4.0.7 | 4.0.7 |
glassfish-jaxbRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.1.4-1.17.patch04.ep1.el4 | 0:2.1.4-1.17.patch04.ep1.el4 |
glassfish-jaxwsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.1.1-1jpp.ep1.13.el4 | 0:2.1.1-1jpp.ep1.13.el4 |
hibernate3Red Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4 | 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4 |
hibernate3-annotationsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:3.3.1-2.0.GA_CP04.ep1.el4 | 0:3.3.1-2.0.GA_CP04.ep1.el4 |
hibernate3-annotations-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:3.3.1-2.0.GA_CP04.ep1.el4 | 0:3.3.1-2.0.GA_CP04.ep1.el4 |
hibernate3-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4 | 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4 |
javassistRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:3.9.0-2.ep1.1.el4 | 0:3.9.0-2.ep1.1.el4 |
jboss-commonRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:1.2.2-1.ep1.1.el4 | 0:1.2.2-1.ep1.1.el4 |
jboss-messagingRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:1.4.0-4.SP3_CP11.1.ep1.el4 | 0:1.4.0-4.SP3_CP11.1.ep1.el4 |
Show 42 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.2.3-4.SP3.ep1.el4 | 0:2.2.3-4.SP3.ep1.el4 |
jboss-seamRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el4 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el4 |
jboss-seam-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el4 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el4 |
jboss-seam2Red Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.2.FP-1.ep1.26.el4 | 0:2.0.2.FP-1.ep1.26.el4 |
jboss-seam2-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.2.FP-1.ep1.26.el4 | 0:2.0.2.FP-1.ep1.26.el4 |
jbossasRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:4.3.0-8.GA_CP09.2.ep1.el4 | 0:4.3.0-8.GA_CP09.2.ep1.el4 |
jbossas-4.3.0.GA_CP09-binRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:4.3.0-8.GA_CP09.2.ep1.el4 | 0:4.3.0-8.GA_CP09.2.ep1.el4 |
jbossas-clientRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:4.3.0-8.GA_CP09.2.ep1.el4 | 0:4.3.0-8.GA_CP09.2.ep1.el4 |
jbosstsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el4 | 1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el4 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.0-7.CP15.0jpp.ep1.1.el4 | 0:2.0.0-7.CP15.0jpp.ep1.1.el4 |
jbosswsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.1-6.SP2_CP09.2.ep1.el4 | 0:2.0.1-6.SP2_CP09.2.ep1.el4 |
jbossws-commonRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:1.0.0-3.GA_CP06.1.ep1.el4 | 0:1.0.0-3.GA_CP06.1.ep1.el4 |
jgroupsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 1:2.4.9-1.ep1.el4 | 1:2.4.9-1.ep1.el4 |
rh-eap-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:4.3.0-8.GA_CP09.ep1.3.el4 | 0:4.3.0-8.GA_CP09.ep1.3.el4 |
rh-eap-docs-examplesRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:4.3.0-8.GA_CP09.ep1.3.el4 | 0:4.3.0-8.GA_CP09.ep1.3.el4 |
xalan-j2Red Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.7.1-4.ep1.1.el4 | 0:2.7.1-4.ep1.1.el4 |
glassfish-jaxbRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.1.4-1.17.patch04.ep1.el5 | 0:2.1.4-1.17.patch04.ep1.el5 |
glassfish-jaxwsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.1.1-1jpp.ep1.13.el5 | 0:2.1.1-1jpp.ep1.13.el5 |
hibernate3Red Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el5 | 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el5 |
hibernate3-annotationsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:3.3.1-2.0.GA_CP04.ep1.el5 | 0:3.3.1-2.0.GA_CP04.ep1.el5 |
hibernate3-annotations-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:3.3.1-2.0.GA_CP04.ep1.el5 | 0:3.3.1-2.0.GA_CP04.ep1.el5 |
hibernate3-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el5 | 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el5 |
javassistRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:3.9.0-2.ep1.1.el5 | 0:3.9.0-2.ep1.1.el5 |
jboss-commonRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.2.2-1.ep1.1.el5 | 0:1.2.2-1.ep1.1.el5 |
jboss-messagingRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.4.0-4.SP3_CP11.1.ep1.el5 | 0:1.4.0-4.SP3_CP11.1.ep1.el5 |
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.2.3-4.SP3.ep1.el5 | 0:2.2.3-4.SP3.ep1.el5 |
jboss-seamRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el5.1 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el5.1 |
jboss-seam-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el5.1 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el5.1 |
jboss-seam2Red Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.2.FP-1.ep1.26.el5 | 0:2.0.2.FP-1.ep1.26.el5 |
jboss-seam2-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.2.FP-1.ep1.26.el5 | 0:2.0.2.FP-1.ep1.26.el5 |
jbossasRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:4.3.0-8.GA_CP09.2.1.ep1.el5 | 0:4.3.0-8.GA_CP09.2.1.ep1.el5 |
jbossas-4.3.0.GA_CP09-binRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:4.3.0-8.GA_CP09.2.1.ep1.el5 | 0:4.3.0-8.GA_CP09.2.1.ep1.el5 |
jbossas-clientRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:4.3.0-8.GA_CP09.2.1.ep1.el5 | 0:4.3.0-8.GA_CP09.2.1.ep1.el5 |
jbosstsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el5 | 1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el5 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.0-7.CP15.0jpp.ep1.1.el5 | 0:2.0.0-7.CP15.0jpp.ep1.1.el5 |
jbosswsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.1-6.SP2_CP09.2.ep1.el5 | 0:2.0.1-6.SP2_CP09.2.ep1.el5 |
jbossws-commonRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.0.0-3.GA_CP06.1.ep1.el5 | 0:1.0.0-3.GA_CP06.1.ep1.el5 |
jgroupsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 1:2.4.9-1.ep1.el5 | 1:2.4.9-1.ep1.el5 |
quartzRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.5.2-1jpp.patch01.ep1.4.2.el5 | 0:1.5.2-1jpp.patch01.ep1.4.2.el5 |
rh-eap-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:4.3.0-8.GA_CP09.ep1.3.el5 | 0:4.3.0-8.GA_CP09.ep1.3.el5 |
rh-eap-docs-examplesRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:4.3.0-8.GA_CP09.ep1.3.el5 | 0:4.3.0-8.GA_CP09.ep1.3.el5 |
xalan-j2Red Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.7.1-4.ep1.1.el5 | 0:2.7.1-4.ep1.1.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3708 is a high vulnerability (CVSS 7.5) in Redhat Jboss Enterprise Application Platform, published December 30, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.02%, the 87th percentile. Fixed in org.drools:drools-core 4.0.7.
References
redhat.com/support/errata/RHSA-2010-0940.html
bugzilla.redhat.com/show_bug.cgi?id=633859
issues.jboss.org/browse/SOA-2319
Show 22 moreShow less
securitytracker.com/id?1024813
nvd.nist.gov/vuln/detail/CVE-2010-3708
web.archive.org/web/20111025030056/http://securitytracker.com/id?1024813
github.com/advisories/GHSA-qvq6-cw53-rmwg
access.redhat.com/errata/RHSA-2010:0937
docs.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3/html-single/Release_Notes_CP09/index.html
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0937.json
cve.org/CVERecord?id=CVE-2010-3708