The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 01:19
Type | Values Removed | Values Added |
---|---|---|
References | () http://securitytracker.com/id?1024813 - | |
References | () http://www.redhat.com/support/errata/RHSA-2010-0937.html - Vendor Advisory | |
References | () http://www.redhat.com/support/errata/RHSA-2010-0938.html - Vendor Advisory | |
References | () http://www.redhat.com/support/errata/RHSA-2010-0939.html - Vendor Advisory | |
References | () http://www.redhat.com/support/errata/RHSA-2010-0940.html - Vendor Advisory | |
References | () https://bugzilla.redhat.com/show_bug.cgi?id=633859 - | |
References | () https://issues.jboss.org/browse/SOA-2319 - |
Information
Published : 2010-12-30 21:00
Updated : 2024-11-21 01:19
NVD link : CVE-2010-3708
Mitre link : CVE-2010-3708
CVE.ORG link : CVE-2010-3708
JSON object : View
Products Affected
redhat
- jboss_enterprise_application_platform
- jboss_enterprise_soa_platform
CWE
CWE-20
Improper Input Validation