8.8Yüksek
KEV
CVE-2010-1871Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
Aktif olarak istismar ediliyor — Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 10.12.2021 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 10.06.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2010-1871
Açıklama
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
Zayıflık türü (CWE):
CWE-917
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| netapp | oncommand balance | — | |
| netapp | oncommand insight | — | |
| netapp | oncommand unified manager | — | |
| redhat | jboss enterprise application platform | 4.3.0 |
Kaynaklar ve yamalar
- 41994 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 20130528 CA20130528-01: Security Notice for CA Process Automation (CA PAM) mailing-listBroken Link
- 1024253 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- ADV-2010-1929 vdb-entryBroken LinkVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=615956 Issue Tracking
- seam-expressions-code-execution(60794) vdb-entryThird Party AdvisoryVDB Entry
- RHSA-2010:0564 vendor-advisoryBroken Link
- https://security.netapp.com/advisory/ntap-20161017-0001/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1871 US Government Resource
CPE eşleşmeleri (NVD) (4)
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:clustered_data_ontap:*:*