{"id":"CVE-2010-1871","published":"2010-08-05T13:23:09Z","modified":"2026-06-16T23:19:29Z","title":"Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability","vendor":"Red Hat","product":"JBoss Seam 2","tier":"core","eol":null,"description":{"text":"JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL.  NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.","provenance":"source","from":"NVD"},"summary":{"text":"Red Hat JBoss Seam 2 (jboss-seam2), as shipped in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, fails to properly sanitise input used in JBoss Expression Language (EL) expressions. An remote attacker can execute arbitrary code by sending a crafted URL, without authentication or privileges, but this requires a user to interact with the crafted request and only applies when the Java Security Manager is not properly configured.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:48Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.83397,"percentile":0.99681,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-12-10","dueDate":"2022-06-10","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-1871","provenance":"source"},"vulncheckKev":{"dateAdded":"2011-07-30","exploitedFirstSeen":"2011-07-30","ransomware":false,"evidence":[{"url":"https://raesene.github.io/blog/2011/07/30/from-poc-to-shell-cve-2010-1871/","date":"2011-07-30"},{"url":"https://blogs.juniper.net/en-us/threat-research/everything-but-the-kitchen-sink-more-attacks-from-the-gitpaste-12-worm","date":"2020-12-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-12-10"},{"url":"https://vulone.com/blog/a-china-linked-operator-used-ai-agents-to-attack-governments-across-asia","date":"2026-10-19"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-917","name":"Improper Neutralization of Special Elements used in an Expression Language Statement"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html","tags":["Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0564.html","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/41994","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1024253","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.vupen.com/english/advisories/2010/1929","tags":["Broken Link","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=615956","tags":["Issue Tracking"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/60794","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://security.netapp.com/advisory/ntap-20161017-0001/","tags":["Third Party Advisory"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html","tags":["Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0564.html","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/41994","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1024253","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.vupen.com/english/advisories/2010/1929","tags":["Broken Link","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=615956","tags":["Issue Tracking"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/60794","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://security.netapp.com/advisory/ntap-20161017-0001/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1871","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote attacker exploits public-facing JBoss app input","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers","start":102,"end":213}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"needs user interaction; not a public-facing exploit"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution via crafted URL","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code via a crafted URL","start":190,"end":257}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-47d1c126a36d01f3bea4","title":"SpeakUp: A New Undetected Backdoor Linux Trojan","publisher":"research.checkpoint.com","url":"https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/","date":"2019-02-04","mentions":[{"quote":"b) CVE-2010-1871: JBoss Seam Framework remote code execution","start":6424,"end":6484},{"quote":"Component Remote Code Execution (CVE-2017-10271)\n- Oracle WebLogic WLS Server Component Arbitrary File Upload(CVE-2018-2894)\n- Hadoop YARN ResourceManager Remote Command Execution\n- Apache ActiveMQ Fileserver Multi Methods Directory Traversal(CVE-2016-3088)\n- JBoss Seam 2 Framework Remote Code Execution (CVE-2010-1871)","start":9999,"end":10319}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2010-1890","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-1890","exploited":true,"exploitedSince":"2021-12-10","provenance":"source"},"exploits":[{"id":36653,"url":"https://www.exploit-db.com/exploits/36653","title":"JBoss Seam 2 - Arbitrary File Upload / Execution (Metasploit)","type":"remote","platform":"jsp","date":"2015-04-06","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-04-06"},"metasploit":[{"name":"JBoss Seam 2 Remote Command Execution","module":"auxiliary/admin/http/jboss_seam_exec","type":"auxiliary","disclosureDate":"2010-07-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_seam_exec.rb"},{"name":"JBoss Seam 2 File Upload and Execute","module":"exploit/multi/http/jboss_seam_upload_exec","type":"exploit","disclosureDate":"2010-08-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_seam_upload_exec.rb"}],"first":{"date":"2010-07-19","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_seam_exec.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2010-07-19","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2015-04-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_seam_exec.rb","provenance":"source"},{"date":"2010-08-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1871","provenance":"source"},{"date":"2011-07-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://raesene.github.io/blog/2011/07/30/from-poc-to-shell-cve-2010-1871/","provenance":"source"},{"date":"2019-02-04","kind":"report","label":"Named in research.checkpoint.com: SpeakUp: A New Undetected Backdoor Linux Trojan","url":"https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/","provenance":"machine"},{"date":"2021-12-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-12-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-1890","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":4145},"priority":{"score":73.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5571 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9968"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 2 Metasploit modules"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}