CVE-2010-3708

EPSS 2.42%
Published 30.12.2010 21:00:01
Last modified 11.04.2025 00:51:21
Source secalert@redhat.com
Teams watchlist Login
Open Login

The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.

Affected products Warnungen 0 Metrics 2 CWE 1 References 10

Data is provided by the National Vulnerability Database (NVD)

Redhat ≫ Jboss Enterprise Application Platform Version4.3.0

Redhat ≫ Jboss Enterprise Application Platform Version4.3.0 Updatecp01

Redhat ≫ Jboss Enterprise Application Platform Version4.3.0 Updatecp02

Redhat ≫ Jboss Enterprise Application Platform Version4.3.0 Updatecp03

Redhat ≫ Jboss Enterprise Application Platform Version4.3.0 Updatecp04

Redhat ≫ Jboss Enterprise Application Platform Version4.3.0 Updatecp05

Redhat ≫ Jboss Enterprise Application Platform Version4.3.0 Updatecp06

Redhat ≫ Jboss Enterprise Application Platform Version4.3.0 Updatecp07

Redhat ≫ Jboss Enterprise Application Platform Version4.3.0 Updatecp08

Redhat ≫ Jboss Enterprise Soa Platform Version4.2.0

Redhat ≫ Jboss Enterprise Soa Platform Version4.2.0 Updatecp01

Redhat ≫ Jboss Enterprise Soa Platform Version4.2.0 Updatecp02

Redhat ≫ Jboss Enterprise Soa Platform Version4.2.0 Updatecp03

Redhat ≫ Jboss Enterprise Soa Platform Version4.2.0 Updatecp04

Redhat ≫ Jboss Enterprise Soa Platform Version4.2.0 Updatecp05

Redhat ≫ Jboss Enterprise Soa Platform Version4.2.0 Updatetp02

Redhat ≫ Jboss Enterprise Soa Platform Version4.3.0

Redhat ≫ Jboss Enterprise Soa Platform Version4.3.0 Updatecp01

Redhat ≫ Jboss Enterprise Soa Platform Version4.3.0 Updatecp02

Redhat ≫ Jboss Enterprise Soa Platform Version4.3.0 Updatecp03

Redhat ≫ Jboss Enterprise Soa Platform Version4.3.0 Updatecp04

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	2.42%	0.845

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://securitytracker.com/id?1024813

http://www.redhat.com/support/errata/RHSA-2010-0937.html

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2010-0938.html

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2010-0939.html

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2010-0940.html

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=633859

https://issues.jboss.org/browse/SOA-2319

https://nvd.nist.gov/vuln/detail/CVE-2010-3708

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2010-3708

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2010-3708

EUVD