CVE-2010-1871 CVE-2010-1871

漏洞描述

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.

影响产品

redhatjboss_enterprise_application_platform查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

www.securitytracker.comhttp://www.securitytracker.com/id?1024253↗archives.neohapsis.comhttp://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html↗www.redhat.comhttp://www.redhat.com/support/errata/RHSA-2010-0564.html↗exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/60794↗www.vupen.comhttp://www.vupen.com/english/advisories/2010/1929↗bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=615956↗www.securityfocus.comhttp://www.securityfocus.com/bid/41994↗security.netapp.comhttps://security.netapp.com/advisory/ntap-20161017-0001/↗

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
snoop_servlet Snoop Servlet - Information Disclosure Apache Tomcat Jetty Resin+2	低危	—	—	PoCEXP	2024/07/11
CVE-2021-4104RCE CVE-2021-4104 Fedora Weblogic Server jboss_enterprise_application_platform+2	高危	7.5	72.2%	PoCEXP	2021/12/14
CVE-2017-7525RCE CVE-2017-7525 jboss_enterprise_application_platform jackson-databind	严重	9.8	77.3%	PoCEXP	2018/02/06
CVE-2017-17485RCE CVE-2017-17485 jboss_enterprise_application_platform jackson-databind	严重	9.8	77.0%	PoCEXP	2018/01/10
CVE-2015-7501RCE Red Hat JBoss - Insecure Deserialization jboss_enterprise_application_platform	严重	9.8	74.8%	PoCEXP	2017/11/09
CVE-2014-0224 CVE-2014-0224 OpenSSL Node.js Fedora+3	高危	7.4	93.1%	PoCEXP	2014/06/05

利用情报状态

漏洞描述

影响产品

修复建议

参考链接

同产品关联漏洞