{"document":{"aggregate_severity":{"namespace":"https://access.redhat.com/security/updates/classification/","text":"Important"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/vex/2010/cve-2010-1871.json"}],"title":"Seam2: Improper sanitization of parametrized JBoss EL expressions (ACE)","tracking":{"current_release_date":"2025-11-21T14:13:04+00:00","generator":{"date":"2025-11-21T14:13:04+00:00","engine":{"name":"Red Hat SDEngine","version":"4.6.12"}},"id":"CVE-2010-1871","initial_release_date":"2010-07-27T00:00:00+00:00","revision_history":[{"date":"2010-07-27T00:00:00+00:00","number":"1","summary":"Initial version"},{"date":"2024-12-19T18:00:28+00:00","number":"2","summary":"Current version"},{"date":"2025-11-21T14:13:04+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS","product":{"name":"Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS","product_id":"4AS-JBEAP-4.3.0","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0::el4"}}},{"category":"product_name","name":"Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES","product":{"name":"Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES","product_id":"4ES-JBEAP-4.3.0","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0::el4"}}},{"category":"product_name","name":"Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server","product":{"name":"Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server","product_id":"5Server-JBEAP-4.3.0","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0::el5"}}}],"category":"product_family","name":"Red Hat JBoss Enterprise Application Platform"},{"branches":[{"category":"product_version","name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","product":{"name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","product_id":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","product_identification_helper":{"purl":"pkg:rpm/redhat/jboss-seam2@2.0.2.FP-1.ep1.24.el4?arch=src"}}},{"category":"product_version","name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.src","product":{"name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.src","product_id":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.src","product_identification_helper":{"purl":"pkg:rpm/redhat/jboss-seam2@2.0.2.FP-1.ep1.24.el5?arch=src"}}}],"category":"architecture","name":"src"},{"branches":[{"category":"product_version","name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","product":{"name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","product_id":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","product_identification_helper":{"purl":"pkg:rpm/redhat/jboss-seam2@2.0.2.FP-1.ep1.24.el4?arch=noarch"}}},{"category":"product_version","name":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","product":{"name":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","product_id":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","product_identification_helper":{"purl":"pkg:rpm/redhat/jboss-seam2-docs@2.0.2.FP-1.ep1.24.el4?arch=noarch"}}},{"category":"product_version","name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.noarch","product":{"name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.noarch","product_id":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.noarch","product_identification_helper":{"purl":"pkg:rpm/redhat/jboss-seam2@2.0.2.FP-1.ep1.24.el5?arch=noarch"}}},{"category":"product_version","name":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5.noarch","product":{"name":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5.noarch","product_id":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5.noarch","product_identification_helper":{"purl":"pkg:rpm/redhat/jboss-seam2-docs@2.0.2.FP-1.ep1.24.el5?arch=noarch"}}}],"category":"architecture","name":"noarch"}],"category":"vendor","name":"Red Hat"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS","product_id":"4AS-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch"},"product_reference":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","relates_to_product_reference":"4AS-JBEAP-4.3.0"},{"category":"default_component_of","full_product_name":{"name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src as a component of Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS","product_id":"4AS-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src"},"product_reference":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","relates_to_product_reference":"4AS-JBEAP-4.3.0"},{"category":"default_component_of","full_product_name":{"name":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS","product_id":"4AS-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch"},"product_reference":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","relates_to_product_reference":"4AS-JBEAP-4.3.0"},{"category":"default_component_of","full_product_name":{"name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES","product_id":"4ES-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch"},"product_reference":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","relates_to_product_reference":"4ES-JBEAP-4.3.0"},{"category":"default_component_of","full_product_name":{"name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src as a component of Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES","product_id":"4ES-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src"},"product_reference":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","relates_to_product_reference":"4ES-JBEAP-4.3.0"},{"category":"default_component_of","full_product_name":{"name":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES","product_id":"4ES-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch"},"product_reference":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","relates_to_product_reference":"4ES-JBEAP-4.3.0"},{"category":"default_component_of","full_product_name":{"name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server","product_id":"5Server-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.noarch"},"product_reference":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.noarch","relates_to_product_reference":"5Server-JBEAP-4.3.0"},{"category":"default_component_of","full_product_name":{"name":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.src as a component of Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server","product_id":"5Server-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.src"},"product_reference":"jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.src","relates_to_product_reference":"5Server-JBEAP-4.3.0"},{"category":"default_component_of","full_product_name":{"name":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server","product_id":"5Server-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5.noarch"},"product_reference":"jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5.noarch","relates_to_product_reference":"5Server-JBEAP-4.3.0"}]},"vulnerabilities":[{"acknowledgments":[{"names":["Meder Kydyraliev"],"organization":"Google Security Team"}],"cve":"CVE-2010-1871","discovery_date":"2010-07-19T00:00:00+00:00","ids":[{"system_name":"Red Hat Bugzilla ID","text":"615956"}],"notes":[{"category":"description","text":"JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL.  NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.","title":"Vulnerability description"},{"category":"summary","text":"Seam2: Improper sanitization of parametrized JBoss EL expressions (ACE)","title":"Vulnerability summary"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"fixed":["4AS-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","4AS-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","4AS-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","4ES-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","4ES-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","4ES-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","5Server-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.noarch","5Server-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.src","5Server-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5.noarch"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2010-1871"},{"category":"external","summary":"RHBZ#615956","url":"https://bugzilla.redhat.com/show_bug.cgi?id=615956"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2010-1871","url":"https://www.cve.org/CVERecord?id=CVE-2010-1871"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2010-1871","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1871"},{"category":"external","summary":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"release_date":"2010-07-27T00:00:00+00:00","remediations":[{"category":"vendor_fix","date":"2010-07-27T12:51:00+00:00","details":"Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259","product_ids":["4AS-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","4AS-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","4AS-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","4ES-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","4ES-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","4ES-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","5Server-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.noarch","5Server-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.src","5Server-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5.noarch"],"url":"https://access.redhat.com/errata/RHSA-2010:0564"}],"scores":[{"cvss_v2":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":6.8,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","version":"2.0"},"products":["4AS-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","4AS-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","4AS-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","4ES-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","4ES-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","4ES-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","5Server-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.noarch","5Server-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.src","5Server-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5.noarch"]}],"threats":[{"category":"exploit_status","date":"2021-12-10T00:00:00+00:00","details":"CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"category":"impact","details":"Important","product_ids":["4AS-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","4AS-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","4AS-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","4ES-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.noarch","4ES-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el4.src","4ES-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4.noarch","5Server-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.noarch","5Server-JBEAP-4.3.0:jboss-seam2-0:2.0.2.FP-1.ep1.24.el5.src","5Server-JBEAP-4.3.0:jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5.noarch"]}],"title":"Seam2: Improper sanitization of parametrized JBoss EL expressions (ACE)"}]}