{"id":"CVE-2010-1871","kind":"vulnerability","aliases":["CVE-2010-1871"],"related":[],"title":"Red Hat JBoss Seam 2: Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability","description":"JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL.  NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.","summary":"JBoss Seam 2 as shipped in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux lets remote attackers execute code on the server. The flaw is only exploitable when the Java Security Manager is not properly configured, and CISA lists it as actively exploited.","severity":"critical","cvss":8.8,"epss":0.83397,"exploited":true,"exploited_at":"2021-12-10T00:00:00+00:00","products":[{"name":"Red Hat JBoss Seam 2","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","jboss-eap","jboss-seam2","red-hat-linux","runtime"],"not_affected_if":["no-jboss-seam2-deployed","security-manager-properly-configured"],"how_to_check":"Check whether JBoss EAP 4.3.0 with jboss-seam2 is deployed, for example by looking for jboss-seam2 in the deployed application libraries.\nConfirm whether the Java Security Manager is enabled and properly configured for the server.","fix":"Apply the vendor update from Red Hat per CISA guidance; the sources do not name the fixed version.\nEnable and properly configure the Java Security Manager as a mitigation.","status":"open","published_at":"2010-08-05T13:23:09+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:50+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:31:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update from Red Hat per CISA guidance; the sources do not name the fixed version.\nEnable and properly configure the Java Security Manager as a mitigation.","reach":"internet","impact":"high","summary":"JBoss Seam 2 as shipped in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux lets remote attackers execute code on the server. The flaw is only exploitable when the Java Security Manager is not properly configured, and CISA lists it as actively exploited.","category":"runtime","who_cares":["jboss-eap","jboss-seam2","java","red-hat-linux"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the application server remotely.","analyst_note":"Sources do not name affected or fixed versions or the exact Red Hat advisory; check the Red Hat security advisory for CVE-2010-1871 for the fixed release and exact configuration steps.","how_to_check":"Check whether JBoss EAP 4.3.0 with jboss-seam2 is deployed, for example by looking for jboss-seam2 in the deployed application libraries.\nConfirm whether the Java Security Manager is enabled and properly configured for the server.\nunknown","needs_analyst":true,"not_affected_if":["security-manager-properly-configured","no-jboss-seam2-deployed"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000551,"input_tokens":2896,"output_tokens":523,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1871':18A,21A '-2010':17A,20A '2':5A,11A,26A,42B,86C '4.3.0':50B,97C 'activ':82B 'allow':114C 'applic':48B,95C 'arbitrari':119C 'attack':57B,116C 'cisa':78B 'code':13A,59B,120C 'configur':76B,139C 'craft':123C 'cve':16A,19A 'eap':31B 'el':111C 'enterpris':47B,94C 'execut':14A,58B,118C 'exploit':27B,67B,83B 'express':109C,112C 'flaw':64B 'hat':2A,7A,23A,37B,53B,100C 'input':106C 'java':28B,70B,133C 'jboss':3A,9A,24A,30B,33B,40B,46B,84C,88C,93C,108C 'jboss-eap':29B 'jboss-seam2':32B,87C 'languag':110C 'let':55B 'linux':8A,38B,54B,101C 'list':79B 'manag':72B,135C 'note':125C 'platform':49B,96C 'proper':75B,104C,138C 'red':1A,6A,22A,36B,52B,99C 'red-hat-linux':35B 'remot':12A,56B,115C 'runtim':39B 'sanit':105C 'seam':4A,10A,25A,41B,85C 'seam2':34B,89C 'secur':71B,134C 'server':62B 'ship':44B 'url':124C 'use':91C 'via':121C 'vulner':15A,130C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2010-08-05T13:23:09+00:00","kev":{"dateAdded":"2021-12-10","dueDate":"2022-06-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2010-1871","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-1871","severity":null,"published_at":"2021-12-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T19:35:26+00:00","note":null},{"source":"epss","external_id":"CVE-2010-1871","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-1871","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2010-1871","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1871","severity":null,"published_at":"2010-08-05T13:23:09+00:00","modified_at":"2026-06-16T23:19:29+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}