CVE-2010-3708

2010-12-3021:00:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2010-3708

jboss drools

red hat

jboss eap

jbeap

jboss enterprise soa platform

remote code execution

serialization

security vulnerability

7.4 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.113 Low

EPSS

Percentile

95.2%

JSON

The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.

CPENameOperatorVersion
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq4.3.0
redhat:jboss_enterprise_soa_platformredhat jboss enterprise soa platformeq4.3.0
redhat:jboss_enterprise_soa_platformredhat jboss enterprise soa platformeq4.2.0

CPE	Name	Operator	Version
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	4.3.0
redhat:jboss_enterprise_soa_platform	redhat jboss enterprise soa platform	eq	4.3.0
redhat:jboss_enterprise_soa_platform	redhat jboss enterprise soa platform	eq	4.2.0