CVE-2010-1871
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat...
CVE-2010-1871 is a high vulnerability (CVSS 8.8) in Red Hat Jboss Seam 2, published August 4, 2010. CISA lists it as known to be exploited, since December 10, 2021. EUVD reports exploitation since December 10, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 83.4%, the 99th percentile. Fixed in jboss-seam2 0:2.0.2.FP-1.ep1.24.el4.
- Severity
- 8.8 HighCVSS 3.1, NVD
- Exploit chance
- 83.4%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
0:2.0.2.FP-1.ep1.24.el4jboss-seam2 +3 more
Description
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jboss-seam2Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | before 0:2.0.2.FP-1.ep1.24.el4 | 0:2.0.2.FP-1.ep1.24.el4 |
jboss-seam2-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 | before 0:2.0.2.FP-1.ep1.24.el4 | 0:2.0.2.FP-1.ep1.24.el4 |
jboss-seam2Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | before 0:2.0.2.FP-1.ep1.24.el5 | 0:2.0.2.FP-1.ep1.24.el5 |
jboss-seam2-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 | before 0:2.0.2.FP-1.ep1.24.el5 | 0:2.0.2.FP-1.ep1.24.el5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | JBoss Seam 2 File Upload and Execute | 2010-08-05 |
| Exploit-DB | JBoss Seam 2 - Arbitrary File Upload / Execution (Metasploit) | 2015-04-06 |
| Metasploit | JBoss Seam 2 Remote Command Execution | 2010-07-19 |
What each source reports
NVD Score used
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
- Record
CVE-2010-1871- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-917
- Updated
- 2026-11-02
CVE List
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
- Record
CVE-2010-1871- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-917
- Updated
- 2026-11-02
EUVDEUVD-2010-1890
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
- Record
EUVD-2010-1890- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r6fv-qmrc-3h24
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat...
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
- Record
GHSA-r6fv-qmrc-3h24- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-917
- Updated
- 2026-11-02
CISA KEVNo score
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
- Record
CVE-2010-1871- Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/41994
archives.neohapsis.com/archives/bugtraq/2013-05/0117.html
securitytracker.com/id?1024253
vupen.com/english/advisories/2010/1929
bugzilla.redhat.com/show_bug.cgi?id=615956
exchange.xforce.ibmcloud.com/vulnerabilities/60794
Show 11 moreShow less
redhat.com/support/errata/RHSA-2010-0564.html
security.netapp.com/advisory/ntap-20161017-0001
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1871
nvd.nist.gov/vuln/detail/CVE-2010-1871
github.com/advisories/GHSA-r6fv-qmrc-3h24
access.redhat.com/errata/RHSA-2010:0564
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0564.json
cve.org/CVERecord?id=CVE-2010-1871