CVE-2010-1871 KEVPublic exploit High · 8.8 EPSS 83.4%

Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability

Red Hat · JBoss Seam 2

Summary

Red Hat JBoss Seam 2 (jboss-seam2), as shipped in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, fails to properly sanitise input used in JBoss Expression Language (EL) expressions. An remote attacker can execute arbitrary code by sending a crafted URL, without authentication or privileges, but this requires a user to interact with the crafted request and only applies when the Java Security Manager is not properly configured.

Official description · NVD

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.

Breakdown

73.0 / 100

Exploited: Yes, in CISA KEV
Reports: 1
Tactics: 1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 12 months after disclosure. Public exploit code (Metasploit) was available 17 days before disclosure.

Public exploit codeMetasploit19 Jul 201017 days before
Disclosed5 Aug 2010day 0
First seen exploitedVulnCheck KEV evidence30 Jul 2011+12 mo
Named in a threat reportresearch.checkpoint.com4 Feb 2019+9 yrs
Added to CISA KEVEU database agrees10 Dec 2021+11 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

1 , grouped by in kill-chain order, 2 cited passages 1

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

arbitrary code execution via crafted URL

allows remote attackers to execute arbitrary code via a crafted URL

From the official description (NVD) Original ↗

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Exploit Public-Facing ApplicationT1190 needs user interaction; not a public-facing exploit

Detection

0 rules for this CVE · 95 general rules for its techniques

Rules for this CVE

0 that reference CVE-2010-1871 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report

1 reportCheck PointFeb 2019

Reports are matched by finding the exact id CVE-2010-1871 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Check Point4 Feb 2019

SpeakUp: A New Undetected Backdoor Linux Trojan

Component Remote Code Execution (CVE-2017-10271) Oracle WebLogic WLS Server Component Arbitrary File Upload(CVE-2018-2894) Hadoop YARN ResourceManager Remote Command Execution Apache ActiveMQ Fileserver Multi Methods Directory Traversal(CVE-2016-3088) JBoss Seam 2 Framework Remote Code Execution (CVE-2010-1871)

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

9 links, grouped by NVD tag (8 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 10 Dec 2021. Federal due date 10 Jun 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 10 Dec 2021. EUVD-2010-1890

JBoss Seam 2 - Arbitrary File Upload / Execution (Metasploit)EDB-36653 · remote · jsp · 2015-04-06 · verified

, 30 Oct 2026

83.4%Top 0.32%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.68%).

3.1

8.8High · 8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 5572 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9968 19.9/20

Threat reports1 report 3.9/10

Public exploit code1 Exploit-DB entry; 2 Metasploit modules 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 8.8 6.2/7

End-of-life productsupported or unknown 0.0

Total73.0

Record

Published: 5 Aug 2010
Modified: 16 Jun 2026
: CWE-917 Improper Neutralization of Special Elements used in an Expression Language StatementCWE-20 Improper Input Validation
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

SpeakUp: A New Undetected Backdoor Linux Trojan

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 4

Issue Tracking 1

Broken Link 2

What they do

techniques