CVE-2010-3708
published 2010-12-30CVE-2010-3708: The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss…
PriorityP344high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
3.02%
85.9th percentile
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | jboss_enterprise_soa_platform | — | — |
| redhat | jboss_enterprise_soa_platform | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP
osv·2022-05-17
CVE-2010-3708 [HIGH] Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP
Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
The maintainers of JBoss EAP patched the vulnerability by applying a fix from Drools 4.0.7.
GHSA
Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP
ghsa·2022-05-17
CVE-2010-3708 [HIGH] CWE-20 Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP
Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
The maintainers of JBoss EAP patched the vulnerability by applying a fix from Drools 4.0.7.
Red Hat
JBoss drools deserialization remote code execution
vendor_redhat·2010-12-01·CVSS 7.5
CVE-2010-3708 [HIGH] CWE-502 JBoss drools deserialization remote code execution
JBoss drools deserialization remote code execution
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
No detection rules found.
No public exploits indexed.
http://securitytracker.com/id?1024813http://www.redhat.com/support/errata/RHSA-2010-0937.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0938.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0939.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0940.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=633859https://issues.jboss.org/browse/SOA-2319http://securitytracker.com/id?1024813http://www.redhat.com/support/errata/RHSA-2010-0937.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0938.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0939.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0940.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=633859https://issues.jboss.org/browse/SOA-2319
2010-12-30
Published