CVE-2010-1871: JBoss Seam 2 EL injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a very high EPSS score and allows unauthenticated remote code execution, though exploitation requires user interaction and a misconfigured Security Manager.

What it is

JBoss Seam 2, as shipped in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, fails to sanitize input used in JBoss Expression Language expressions. A crafted URL can therefore inject an EL expression that the server evaluates, leading to arbitrary code execution. The flaw only manifests when the Java Security Manager is not properly configured, so exposure depends on deployment hardening.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the application server, giving full control of the host and any data it can reach.

Attack surface

Reached over the network via a crafted URL against a Seam 2 application; no authentication is required, but the CVSS vector indicates user interaction is needed for the attack to succeed.

Exploitation

Listed in CISA KEV since 2021-12-10 with a required action to apply vendor updates, and EPSS shows a 30-day probability of 0.834 (99.7th percentile), indicating active exploitation and high likelihood. No ransomware campaign use is documented.

What to do

• Apply the Red Hat errata (RHSA-2010-0564) or the current vendor update for JBoss Enterprise Application Platform and Seam 2.
• Patch or remove affected NetApp OnCommand products per the NetApp advisory ntap-20161017-0001.
• Enable and correctly configure the Java Security Manager so EL evaluation is restricted.
• Restrict network access to Seam 2 application endpoints and filter requests containing EL expression syntax.
• Retire or isolate end-of-life JBoss EAP 4.3.0 deployments that cannot be patched.

Detection

• Monitor web and application logs for URLs containing EL delimiters such as ${ or #{} in request parameters.
• Alert on unexpected child processes or command execution spawned by the JBoss/Java process.
• Review JBoss Seam application access logs for anomalous request patterns from single source IPs.
• Audit Java Security Manager configuration on Seam 2 hosts to confirm it is enabled and enforcing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.