CVE-2010-1871

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 16, 2026

Description

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-917

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.htmlBroken Link
http://www.redhat.com/support/errata/RHSA-2010-0564.htmlBroken Link
http://www.securityfocus.com/bid/41994Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1024253Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2010/1929Broken Link, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=615956Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/60794Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20161017-0001/Third Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.htmlBroken Link
http://www.redhat.com/support/errata/RHSA-2010-0564.htmlBroken Link
http://www.securityfocus.com/bid/41994Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1024253Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2010/1929Broken Link, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=615956Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/60794Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20161017-0001/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1871US Government Resource

Timeline

Published: Aug 5, 2010
Last modified: Jun 16, 2026
Added to CISA KEV: Dec 10, 2021
NVD status: Analyzed

Related CVEs from 2010

CVE-2010-18724.3Cross-site scripting (XSS) vulnerability in cPlayer.php in FlashCard 2.6.5 and 3.0.1 allows remote attackers to inject arbitrary web script CVE-2010-18737.5SQL injection vulnerability in the Jvehicles (com_jvehicles) component 1.0, 2.0, and 2.1111 for Joomla! allows remote attackers to execute a CVE-2010-18747.5SQL injection vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote attackers to execute CVE-2010-18757.5Directory traversal vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote attackers to re CVE-2010-18767.5SQL injection vulnerability in index.php in AJ Shopping Cart 1.0 allows remote attackers to execute arbitrary SQL commands via the maincatid CVE-2010-18777.5SQL injection vulnerability in the JTM Reseller (com_jtm) component 1.9 Beta for Joomla! allows remote attackers to execute arbitrary SQL co CVE-2010-18787.5Directory traversal vulnerability in the OrgChart (com_orgchart) component 1.0.0 for Joomla! allows remote attackers to read arbitrary files CVE-2010-18799.3Unspecified vulnerability in Quartz.dll for DirectShow; Windows Media Format Runtime 9, 9.5, and 11; Media Encoder 9; and the Asycfilt.dll C CVE-2010-18809.3Unspecified vulnerability in Quartz.dll for DirectShow on Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1, and Server CVE-2010-18819.3The FieldList ActiveX control in the Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 does not properly in CVE-2010-18829.3Multiple buffer overflows in the MPEG Layer-3 Audio Codec for Microsoft DirectShow in l3codecx.ax in Microsoft Windows XP SP2 and SP3 and Se CVE-2010-18837.8Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1