6.8

CVE-2011-2196

jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP05 and 5.1.0; JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0, 4.3.0.CP09, and 5.1.1; and JBoss Enterprise Web Platform 5.1.1, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1484.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Jboss Enterprise Application Platform Version 4.3.0 Update cp09
Redhat ≫ Jboss Enterprise Soa Platform Version 4.3.0 Update cp05
Redhat ≫ Jboss Seam 2 Framework Version <= 2.2.2
Redhat ≫ Jboss Seam 2 Framework Version 2.0.0 Update beta1
Redhat ≫ Jboss Seam 2 Framework Version 2.0.0 Update cr1
Redhat ≫ Jboss Seam 2 Framework Version 2.0.0 Update cr2
Redhat ≫ Jboss Seam 2 Framework Version 2.0.0 Update cr3
Redhat ≫ Jboss Seam 2 Framework Version 2.0.0 Update ga
Redhat ≫ Jboss Seam 2 Framework Version 2.0.1 Update cr1
Redhat ≫ Jboss Seam 2 Framework Version 2.0.1 Update cr2
Redhat ≫ Jboss Seam 2 Framework Version 2.0.1 Update ga
Redhat ≫ Jboss Seam 2 Framework Version 2.0.2 Update cr1
Redhat ≫ Jboss Seam 2 Framework Version 2.0.2 Update cr2
Redhat ≫ Jboss Seam 2 Framework Version 2.0.2 Update ga
Redhat ≫ Jboss Seam 2 Framework Version 2.0.2 Update sp1
Redhat ≫ Jboss Seam 2 Framework Version 2.0.3 Update cr1
Redhat ≫ Jboss Seam 2 Framework Version 2.1.0 Update alpha1
Redhat ≫ Jboss Seam 2 Framework Version 2.1.0 Update beta1
Redhat ≫ Jboss Seam 2 Framework Version 2.1.0 Update cr1
Redhat ≫ Jboss Seam 2 Framework Version 2.1.0 Update ga
Redhat ≫ Jboss Seam 2 Framework Version 2.1.0 Update sp1
Redhat ≫ Jboss Seam 2 Framework Version 2.1.1 Update cr1
Redhat ≫ Jboss Seam 2 Framework Version 2.1.1 Update cr2
Redhat ≫ Jboss Seam 2 Framework Version 2.1.1 Update ga
Redhat ≫ Jboss Seam 2 Framework Version 2.1.2
Redhat ≫ Jboss Seam 2 Framework Version 2.1.2 Update cr1
Redhat ≫ Jboss Seam 2 Framework Version 2.1.2 Update cr2
Redhat ≫ Jboss Seam 2 Framework Version 2.2.0 Update cr1
Redhat ≫ Jboss Seam 2 Framework Version 2.2.0 Update ga
Redhat ≫ Jboss Seam 2 Framework Version 2.2.1
Redhat ≫ Jboss Seam 2 Framework Version 2.2.1 Update cr1
Redhat ≫ Jboss Seam 2 Framework Version 2.2.1 Update cr2
Redhat ≫ Jboss Seam 2 Framework Version 2.2.1 Update cr3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.59% 0.833
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.redhat.com/support/errata/RHSA-2011-0945.html
http://www.redhat.com/support/errata/RHSA-2011-0946.html
http://www.redhat.com/support/errata/RHSA-2011-0947.html
http://www.redhat.com/support/errata/RHSA-2011-0948.html
http://www.redhat.com/support/errata/RHSA-2011-0949.html
http://www.redhat.com/support/errata/RHSA-2011-0950.html
http://www.redhat.com/support/errata/RHSA-2011-0951.html
http://www.redhat.com/support/errata/RHSA-2011-0952.html
Vendor Advisory
http://www.securityfocus.com/bid/48716
https://bugzilla.redhat.com/show_bug.cgi?id=712283