Lucene search

[email protected]CVE-2011-1484

HistoryJul 27, 2011 - 2:42 a.m.

CVE-2011-1484

2011-07-2702:42:27

CWE-264

[email protected]

web.nvd.nist.gov

cve-2011-1484

jboss seam

jboss enterprise soa platform

jboss eap

expression language

remote code execution

security vulnerability

7.3 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

86.1%

JSON

jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application.

Affected configurations

NVD

Node

redhatjboss_enterprise_application_platformMatch4.3.0cp09

redhatjboss_enterprise_application_platformMatch5.1.0

redhatjboss_enterprise_soa_platformMatch4.3.0cp04

redhatjboss_enterprise_soa_platformMatch5.1.0

redhatjboss_seam_2_frameworkRange≤2.2.2

redhatjboss_seam_2_frameworkMatch2.0.0beta1

redhatjboss_seam_2_frameworkMatch2.0.0cr1

redhatjboss_seam_2_frameworkMatch2.0.0cr2

redhatjboss_seam_2_frameworkMatch2.0.0cr3

redhatjboss_seam_2_frameworkMatch2.0.0ga

redhatjboss_seam_2_frameworkMatch2.0.1cr1

redhatjboss_seam_2_frameworkMatch2.0.1cr2

redhatjboss_seam_2_frameworkMatch2.0.1ga

redhatjboss_seam_2_frameworkMatch2.0.2cr1

redhatjboss_seam_2_frameworkMatch2.0.2cr2

redhatjboss_seam_2_frameworkMatch2.0.2ga

redhatjboss_seam_2_frameworkMatch2.0.2sp1

redhatjboss_seam_2_frameworkMatch2.0.3cr1

redhatjboss_seam_2_frameworkMatch2.1.0alpha1

redhatjboss_seam_2_frameworkMatch2.1.0beta1

redhatjboss_seam_2_frameworkMatch2.1.0cr1

redhatjboss_seam_2_frameworkMatch2.1.0ga

redhatjboss_seam_2_frameworkMatch2.1.0sp1

redhatjboss_seam_2_frameworkMatch2.1.1cr1

redhatjboss_seam_2_frameworkMatch2.1.1cr2

redhatjboss_seam_2_frameworkMatch2.1.1ga

redhatjboss_seam_2_frameworkMatch2.1.2

redhatjboss_seam_2_frameworkMatch2.1.2cr1

redhatjboss_seam_2_frameworkMatch2.1.2cr2

redhatjboss_seam_2_frameworkMatch2.2.0cr1

redhatjboss_seam_2_frameworkMatch2.2.0ga

redhatjboss_seam_2_frameworkMatch2.2.1

redhatjboss_seam_2_frameworkMatch2.2.1cr1

redhatjboss_seam_2_frameworkMatch2.2.1cr2

redhatjboss_seam_2_frameworkMatch2.2.1cr3

CPENameOperatorVersion
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq4.3.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.1.0
redhat:jboss_enterprise_soa_platformredhat jboss enterprise soa platformeq4.3.0
redhat:jboss_enterprise_soa_platformredhat jboss enterprise soa platformeq5.1.0
redhat:jboss_seam_2_frameworkredhat jboss seam 2 frameworkle2.2.2
redhat:jboss_seam_2_frameworkredhat jboss seam 2 frameworkeq2.0.0
redhat:jboss_seam_2_frameworkredhat jboss seam 2 frameworkeq2.0.1
redhat:jboss_seam_2_frameworkredhat jboss seam 2 frameworkeq2.0.2
redhat:jboss_seam_2_frameworkredhat jboss seam 2 frameworkeq2.0.3
redhat:jboss_seam_2_frameworkredhat jboss seam 2 frameworkeq2.1.0

CPE	Name	Operator	Version
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	4.3.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.1.0
redhat:jboss_enterprise_soa_platform	redhat jboss enterprise soa platform	eq	4.3.0
redhat:jboss_enterprise_soa_platform	redhat jboss enterprise soa platform	eq	5.1.0
redhat:jboss_seam_2_framework	redhat jboss seam 2 framework	le	2.2.2
redhat:jboss_seam_2_framework	redhat jboss seam 2 framework	eq	2.0.0
redhat:jboss_seam_2_framework	redhat jboss seam 2 framework	eq	2.0.1
redhat:jboss_seam_2_framework	redhat jboss seam 2 framework	eq	2.0.2
redhat:jboss_seam_2_framework	redhat jboss seam 2 framework	eq	2.0.3
redhat:jboss_seam_2_framework	redhat jboss seam 2 framework	eq	2.1.0